Pphpseclib

Products

Exploited and recent CVEs

• CVE-2026-84308 Medium 6.3 phpseclib — non-constant-time X25519 scalar multiplication permits full private-key recovery 0.3%
• CVE-2026-55599 Medium 5.8 phpseclib: X.509 certificate validation sends attacker-controlled outbound requests (server-side request forgery) via Authority Information Access 0.2%
• CVE-2026-44167 High 7.5 phpseclib: CVE-2024-27355 mitigation bypass — OID amplification DoS in ASN1::decodeOID() 0.2%
• CVE-2026-40194 Low 3.7 phpseclib has a variable-time HMAC comparison in SSH2::get_binary_packet() using != instead of hash_equals() 0.4%
• CVE-2026-32935 High 8.2 phpseclib's AES-CBC unpadding susceptible to padding oracle timing attack 0.4%