Skip to content
Noroxi

phpseclib records

9 published records for vendor phpseclib.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
0
With a fix record
100%
Median publish → KEV
No record has entered KEV

Records by year

  1. 21
  2. 23
  3. 24
  4. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

9 records
  • CVE-2026-32935
    32Monitor

    phpseclib's AES-CBC unpadding susceptible to padding oracle timing attack

    HighCVSS 8.2No exploitEPSS 0%

    phpseclib · phpseclibMar 19, 2026

  • CVE-2021-30130
    30Monitor

    phpseclib before 2.0.31 and 3.x before 3.0.7 mishandles RSA PKCS#1 v1.5 signature verification.

    HighCVSS 7.5No exploitEPSS 1%

    phpseclib · phpseclibApr 6, 2021

  • CVE-2023-27560
    30Monitor

    Math/PrimeField.php in phpseclib 3.x before 3.0.19 has an infinite loop with composite primefields.

    HighCVSS 7.5No exploitEPSS 1%

    phpseclib · phpseclibMar 3, 2023

  • CVE-2023-49316
    30Monitor

    In Math/BinaryField.php in phpseclib 3 before 3.0.34, excessively large degrees can lead to a denial of service.

    HighCVSS 7.5No exploitEPSS 1%

    phpseclib · phpseclibNov 27, 2023

  • CVE-2024-27354
    30Monitor

    An issue was discovered in phpseclib 1.x before 1.0.23, 2.x before 2.0.47, and 3.x before 3.0.36.

    HighCVSS 7.5No exploitEPSS 1%

    phpseclib · phpseclibMar 1, 2024

  • CVE-2024-27355
    30Monitor

    An issue was discovered in phpseclib 1.x before 1.0.23, 2.x before 2.0.47, and 3.x before 3.0.36.

    HighCVSS 7.5No exploitEPSS 1%

    phpseclib · phpseclibMar 1, 2024

  • CVE-2023-52892
    30Monitor

    In phpseclib before 1.0.22, 2.x before 2.0.46, and 3.x before 3.0.33, some characters in Subject Alternative Name fields in TLS certificates

    HighCVSS 7.5No exploitEPSS 0%

    phpseclib · phpseclibJun 27, 2024

  • CVE-2026-55599
    23Monitor

    phpseclib: X.509 certificate validation sends attacker-controlled outbound requests (server-side request forgery) via Authority Information Access

    MediumCVSS 5.8No exploitEPSS 0%

    phpseclib · phpseclibJun 22, 2026

  • CVE-2026-40194
    14Monitor

    phpseclib has a variable-time HMAC comparison in SSH2::get_binary_packet() using != instead of hash_equals()

    LowCVSS 3.7No exploitEPSS 0%

    phpseclib · phpseclibApr 10, 2026