$_COOKIE names string replacement (. -> _): cookie integrity vulnerabilities

Summary

In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site attackers to set a standard insecure cookie in the victim's browser which is treated as a `Host-` or `Secure-` cookie by PHP applications.

Timeline

1. Sep 28, 2022, 10:25 PM UTCCVE published
2. Jul 16, 2024, 6:53 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: partial

3. Nov 4, 2025, 5:12 PM UTCRecord last updated
4. Oct 28, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• PHP Group PHP

  From 7.4.X · fixed in 7.4.31; From 8.0.X · fixed in 8.0.24; From 8.1.X · fixed in 8.1.11

References 13