CVE-2022-31629: $_COOKIE names string replacement (. -> _): cookie integrity vulnerabilities

Published Sep 28, 2022
·
Updated

$COOKIE names string replacement (. -> ): cookie integrity vulnerabilities

Other sources

Fixed bug GHSA-wpj3-hf5j-x4v4 (Host-/Secure- cookie bypass due to partial CVE-2022-31629 fix). (CVE-2024-2756)

PHP

In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site attackers to set a standard insecure cookie in the victim's browser which is treated as a Host- or Secure- cookie by PHP applications.

Launchpad

Affected Software

11 affected componentsFixes available
PHP PHP<8.1.28
8.1.28
PHP PHP<7.4.31
PHP PHP>=8.0.0<8.0.24
PHP PHP>=8.1.0<8.1.11
Fedoraproject Fedora=35
Fedoraproject Fedora=36
Fedoraproject Fedora=37
Debian Debian Linux=10.0
Debian Debian Linux=11.0
debian/php7.4
7.4.33-1+deb11u57.4.33-1+deb11u8
Microsoft cbl2 php

Remediation

Information

Upgrade to PHP 7.4.31, 8.0.24, or 8.1.11.

Event History

Sep 28, 2022
CVE Published
via MITRE·10:25 PM
Data Sourced
via MITRE·10:25 PM
RemedyDescriptionWeakness
Data Sourced
via NVD·11:15 PM
DescriptionSeverityWeaknessAffected Software
May 31, 2024
Data Sourced
via Launchpad·06:22 PM
Description
Sep 24, 2024
Data Sourced
via Ubuntu·06:42 PM
RemedyDescriptionSeverityAffected Software
Oct 1, 2025
Data Sourced
via Microsoft·11:11 PM
DescriptionSeverityWeakness
Data Sourced
via Microsoft·11:11 PM
Affected Software
Updated
via Microsoft·11:11 PM
DescriptionSeverity

Frequently Asked Questions

1

What is CVE-2022-31629?

CVE-2022-31629 is a vulnerability in PHP versions before 7.4.31, 8.0.24, and 8.1.11 that enables network and same-site attackers to set an insecure cookie in the victim's browser.

2

How does CVE-2022-31629 affect PHP?

CVE-2022-31629 affects PHP versions before 7.4.31, 8.0.24, and 8.1.11 by allowing attackers to set a standard insecure cookie in the victim's browser.

3

How can I fix CVE-2022-31629 in PHP?

To fix CVE-2022-31629 in PHP, update to version 7.4.32, 7.3.31-1~deb10u4, or 7.4.33-1+deb11u3 (or later versions).

4

What are the details of CVE-2022-31629?

CVE-2022-31629 allows network and same-site attackers to set a standard insecure cookie in the victim's browser, which is treated as a `__Host-` or `__Secure-` cookie by PHP applications.

5

Where can I find more information about CVE-2022-31629?

You can find more information about CVE-2022-31629 at the following references: [Link 1](https://www.php.net/ChangeLog-7.php#7.4.32), [Link 2](https://bugs.php.net/bug.php?id=81727), [Link 3](https://github.com/php/php-src/commit/0611be4e82887cee0de6c4cbae320d34eec946ca)

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203