phpseclib vulnerabilities

Newest CVEs

• CVE-2026-84308

  phpseclib — non-constant-time X25519 scalar multiplication permits full private-key recovery

  phpseclib · phpseclib

  Medium6.3
• CVE-2026-55599

  phpseclib: X.509 certificate validation sends attacker-controlled outbound requests (server-side request forgery) via Authority Information Access

  phpseclib · phpseclib

  Medium5.8
• CVE-2026-44167

  phpseclib: CVE-2024-27355 mitigation bypass — OID amplification DoS in ASN1::decodeOID()

  phpseclib · phpseclib

  High7.5
• CVE-2026-40194

  phpseclib has a variable-time HMAC comparison in SSH2::get_binary_packet() using != instead of hash_equals()

  phpseclib · phpseclib

  Low3.7
• CVE-2026-32935

  phpseclib's AES-CBC unpadding susceptible to padding oracle timing attack

  phpseclib · phpseclib

  High8.2