Log in Start free

Vulnerability · Published Jun 22, 2026 · Assigned by GitHub_M

CVE-2026-55599phpseclib: X.509 certificate validation sends attacker-controlled outbound requests (server-side request forgery) via Authority Information Access

Medium 5.8

In plain English

A medium-severity server-side request forgery in phpseclib from phpseclib. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.8Medium
Exploit odds (30 days)0.2%top 88.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

phpseclib is a PHP secure communications library. From 0.1.1 until 1.0.30, 2.0.55, and 3.0.54, when an application validates an untrusted X.509 certificate with phpseclib, X509::validateSignature() reads a URL out of that certificate's Authority Information Access (AIA) extension and connects to it. Attacker who supplies certificate fully controls host, port, and path of that connection. URL fetching is enabled by default, and no destination is blocked. An unauthenticated attacker can therefore make a validating server open connections to internal hosts and ports it should never reach, for example loopback 127.0.0.1, cloud metadata address 169.254.169.254, and internal-only services. This is a server-side request forgery (SSRF) caused by an insecure default. This vulnerability is fixed in 1.0.30, 2.0.55, and 3.0.54.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12php-phpseclibno fix listedDEBIAN-CVE-2026-55599
Debian:13php-phpseclibno fix listedDEBIAN-CVE-2026-55599
Debian:14php-phpseclib2.0.55-1DEBIAN-CVE-2026-55599
Debian:12php-phpseclib3no fix listedDEBIAN-CVE-2026-55599
Debian:13php-phpseclib3no fix listedDEBIAN-CVE-2026-55599
Debian:14php-phpseclib33.0.55-1DEBIAN-CVE-2026-55599
Debian:12phpseclibno fix listedDEBIAN-CVE-2026-55599
Debian:13phpseclibno fix listedDEBIAN-CVE-2026-55599
Packagistphpseclib/phpseclib3.0.54GHSA-m557-wrgg-6rp4
Packagistphpseclib/phpseclib2.0.55GHSA-m557-wrgg-6rp4
Packagistphpseclib/phpseclib1.0.30GHSA-m557-wrgg-6rp4
Ubuntu:22.04:LTSphpseclibno fix listedUBUNTU-CVE-2026-55599
Ubuntu:25.10phpseclibno fix listedUBUNTU-CVE-2026-55599
Ubuntu:26.10phpseclibno fix listedUBUNTU-CVE-2026-55599

Affected products (as reported)

VendorProductVersions
phpseclib phpseclib >= 0.1.1, < 1.0.30>= 2.0.0, < 2.0.55>= 3.0.0, < 3.0.54

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

References