| Version | Supported |
|---|---|
| 1.0.x | ✅ |
| 2.0.x | ✅ |
| 3.0.x | ✅ |
| 4.0.x | ✅ |
To report a security vulnerability, please use the Tidelift security contact. Tidelift will coordinate the fix and disclosure.
Security: phpseclib/phpseclib
Security
SECURITY.md
-
phpseclib 3.0.56 — non-constant-time X25519 scalar multiplication permits full private-key recoveryGHSA-q97c-8qh3-fpc6 published
Aug 26, 2026 by terrafrostModerate -
X.509 certificate validation sends attacker-controlled outbound requests (server-side request forgery) via Authority Information AccessGHSA-m557-wrgg-6rp4 published
Jun 14, 2026 by terrafrostModerate -
issues with X509 hostname verificationGHSA-wc6m-wcx7-q5p2 published
May 21, 2026 by terrafrostHigh -
vulnerabilities in RSA::SIGNATURE_RELAXED_PKCS1GHSA-8p5q-f4jq-7rr3 published
May 21, 2026 by terrafrostHigh -
don't allow composite PrimeFieldsGHSA-3gq8-39j3-92xg published
May 21, 2026 by terrafrostHigh -
guardrails needed on large binaryfield integersGHSA-2f25-pfq3-c7h8 published
May 5, 2026 by terrafrostHigh -
guardrails needed on OID lengthGHSA-f2qx-66wf-wvvx published
May 4, 2026 by terrafrostHigh -
guardrails needed on isPrime and randomPrimeGHSA-2528-jw5q-ww88 published
Apr 27, 2026 by terrafrostHigh -
CVE-2024-27355 mitigation bypass — OID amplification DoS in ASN1::decodeOID()GHSA-3qpq-r242-jqj7 published
Apr 27, 2026 by terrafrostHigh -
Variable-time HMAC comparison in SSH2::get_binary_packet() uses != instead of hash_equals()GHSA-r854-jrxh-36qx published
Apr 10, 2026 by terrafrostLow
Learn more about advisories related to phpseclib/phpseclib in the GitHub Advisory Database