CVE-2026-44167

High

Published: 12/05/2026(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

The phpseclib library for secure communications in PHP prior to versions 1.0.29, 2.0.54, and 3.0.52 allowed loading untrusted ASN1 files, which is a bypass of vulnerability CVE-2024-27355.

Risk Assessment

Organizations may be exposed to attacks related to unauthorized access to data if they use vulnerable versions of the library.

Recommendation

It is recommended to update the phpseclib library to versions 1.0.29, 2.0.54, or 3.0.52 to mitigate this vulnerability.

Other vulnerabilities in phpseclib

CVE-2026-84308Medium
phpseclib before 3.0.57 and 4.0.1 performs pure-PHP X25519 scalar multiplication with data-dependent conditional modular reductions in add() and subtract(). During the Montgomery ladder, reduction behavior depends on the secret scalar prefix, creating observable timing and libgmp call-count differences that can reveal a reused 251-bit clamped private scalar.

Original NVD description (English source)

phpseclib is a PHP secure communications library. Prior to 1.0.29, 2.0.54, and 3.0.52, anyone loading untrusted ASN1 files (eg. X509 certificates, RSA PKCS8 private or public keys, etc). This is a bypass of CVE-2024-27355. This vulnerability is fixed in 1.0.29, 2.0.54, and 3.0.52.