CVE-2024-2408

score

<0.1

cvss

5.9

epss

1.2%

published

2024-06-09

kev added

—

first seen

2026-10-21

The openssl_private_decrypt function in PHP, when using PKCS1 padding, contains a vulnerability caused by the lack of OpenSSL 3.2 changes (rsa_pkcs1_implicit_rejection), letting attackers potentially exploit the Marvin Attack, exploit requires use of vulnerable OpenSSL versions.