Vulnerabilities in phpseclib

4 results

CVE-2026-32935HIGHphpseclib's AES-CBC unpadding susceptible to padding oracle timing attackEPSS 0.4%CVE-2026-40194LOWphpseclib has a variable-time HMAC comparison in SSH2::get_binary_packet() using != instead of hash_equals()EPSS 0.3%CVE-2026-44167HIGHphpseclib: CVE-2024-27355 mitigation bypass — OID amplification DoS in ASN1::decodeOID()EPSS 0.2%CVE-2026-55599MEDIUMphpseclib: X.509 certificate validation sends attacker-controlled outbound requests (server-side request forgery) via Authority Information AccessEPSS 0.1%