p PatchFirst

CVE-2026-40194

CVE-2026-40194 · phpseclib has a variable-time HMAC comparison in SSH2::get_binary_packet() using != instead of hash_equals()

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

phpseclib is a PHP secure communications library. Starting in 0.1.1 and prior to 3.0.51, 2.0.53, and 1.0.28, phpseclib\Net\SSH2::get_binary_packet() uses PHP's != operator to compare a received SSH packet HMAC against the locally computed HMAC. != on equal-length binary strings in PHP uses memcmp(), which short-circuits on the first differing byte. This is a real variable-time comparison (CWE-208), proven by scaling benchmarks. This vulnerability is fixed in 3.0.51, 2.0.53, and 1.0.28.

CVSS 3.7 · Low · EPSS 0.4% · Fix available

Published
Updated

Stack: system · php

Affected products and versions

  • phpseclib

    Versions
    • >= 0.1.1, < 1.0.28: Affected
    • >= 2.0.0, < 2.0.53: Affected
    • >= 3.0.0, < 3.0.51: Affected

    No fix published

  • php-phpseclib Debian:12

    Versions
    • 2.0.42-1
    • 2.0.42-1+deb12u1
    • 2.0.42-1+deb12u2
    • 2.0.42-1+deb12u3
    Affected ranges
    • ECOSYSTEM: < 2.0.42-1+deb12u4

    Update to 2.0.42-1+deb12u4

  • php-phpseclib Debian:13

    Versions
    • 2.0.48-3
    • 2.0.48-3+deb13u1
    Affected ranges
    • ECOSYSTEM: < 2.0.48-3+deb13u2

    Update to 2.0.48-3+deb13u2

  • php-phpseclib Debian:14

    Versions
    • 2.0.48-3
    • 2.0.49-1
    • 2.0.50-1
    • 2.0.51-1
    • 2.0.52-1
    Affected ranges
    • ECOSYSTEM: < 2.0.53-1

    Update to 2.0.53-1

  • php-phpseclib3 Debian:12

    Versions
    • 3.0.19-1
    • 3.0.19-1+deb12u1
    • 3.0.19-1+deb12u2
    • 3.0.19-1+deb12u3
    • 3.0.19-1+deb12u4
    Affected ranges
    • ECOSYSTEM: < 3.0.19-1+deb12u5

    Update to 3.0.19-1+deb12u5

  • php-phpseclib3 Debian:13

    Versions
    • 3.0.43-2
    • 3.0.43-2+deb13u1
    Affected ranges
    • ECOSYSTEM: < 3.0.43-2+deb13u2

    Update to 3.0.43-2+deb13u2

  • php-phpseclib3 Debian:14

    Versions
    • 3.0.43-2
    • 3.0.44-1
    • 3.0.44-2
    • 3.0.45-1
    • 3.0.46-1
    • 3.0.46-2
    • 3.0.47-1
    • 3.0.48-1
    • 3.0.49-1
    • 3.0.50-1
    Affected ranges
    • ECOSYSTEM: < 3.0.51-1

    Update to 3.0.51-1

  • phpseclib Debian:12

    Versions
    • 1.0.20-1
    • 1.0.20-1+deb12u1
    • 1.0.20-1+deb12u2
    • 1.0.20-1+deb12u3
    Affected ranges
    • ECOSYSTEM: < 1.0.20-1+deb12u4

    Update to 1.0.20-1+deb12u4

  • phpseclib Debian:13

    Versions
    • 1.0.23-6
    • 1.0.23-6+deb13u1
    Affected ranges
    • ECOSYSTEM: < 1.0.23-6+deb13u2

    Update to 1.0.23-6+deb13u2

  • phpseclib/phpseclib Packagist

    Versions
    • 0.3.0
    • 0.3.1
    • 0.3.10
    • 0.3.5
    • 0.3.6
    • 0.3.7
    • 0.3.8
    • 0.3.9
    • 1.0.0
    • 1.0.1
    • 1.0.10
    • 1.0.11
    • 1.0.12
    • 1.0.13
    • 1.0.14
    • 1.0.15
    • 1.0.16
    • 1.0.17
    • 1.0.18
    • 1.0.19
    • 1.0.2
    • 1.0.20
    • 1.0.21
    • 1.0.22
    • 1.0.23
    • 1.0.24
    • 1.0.25
    • 1.0.26
    • 1.0.27
    • 1.0.3
    • 1.0.4
    • 1.0.5
    • 1.0.6
    • 1.0.7
    • 1.0.8
    • 1.0.9
    Affected ranges
    • ECOSYSTEM: ≥ 0.1.1, < 1.0.28

    Update to 1.0.28

  • phpseclib/phpseclib Packagist

    Versions
    • 2.0.0
    • 2.0.1
    • 2.0.10
    • 2.0.11
    • 2.0.12
    • 2.0.13
    • 2.0.14
    • 2.0.15
    • 2.0.16
    • 2.0.17
    • 2.0.18
    • 2.0.19
    • 2.0.2
    • 2.0.20
    • 2.0.21
    • 2.0.22
    • 2.0.23
    • 2.0.24
    • 2.0.25
    • 2.0.26
    • 2.0.27
    • 2.0.28
    • 2.0.29
    • 2.0.3
    • 2.0.30
    • 2.0.31
    • 2.0.32
    • 2.0.33
    • 2.0.34
    • 2.0.35
    • 2.0.36
    • 2.0.37
    • 2.0.38
    • 2.0.39
    • 2.0.4
    • 2.0.40
    • 2.0.41
    • 2.0.42
    • 2.0.43
    • 2.0.44
    • 2.0.45
    • 2.0.46
    • 2.0.47
    • 2.0.48
    • 2.0.49
    • 2.0.5
    • 2.0.50
    • 2.0.51
    • 2.0.52
    • 2.0.6
    • 2.0.7
    • 2.0.8
    • 2.0.9
    Affected ranges
    • ECOSYSTEM: ≥ 2.0.0, < 2.0.53

    Update to 2.0.53

  • phpseclib/phpseclib Packagist

    Versions
    • 3.0.0
    • 3.0.1
    • 3.0.10
    • 3.0.11
    • 3.0.12
    • 3.0.13
    • 3.0.14
    • 3.0.15
    • 3.0.16
    • 3.0.17
    • 3.0.18
    • 3.0.19
    • 3.0.2
    • 3.0.20
    • 3.0.21
    • 3.0.22
    • 3.0.23
    • 3.0.3
    • 3.0.33
    • 3.0.34
    • 3.0.35
    • 3.0.36
    • 3.0.37
    • 3.0.38
    • 3.0.39
    • 3.0.4
    • 3.0.40
    • 3.0.41
    • 3.0.42
    • 3.0.43
    • 3.0.44
    • 3.0.45
    • 3.0.46
    • 3.0.47
    • 3.0.48
    • 3.0.49
    • 3.0.5
    • 3.0.50
    • 3.0.6
    • 3.0.7
    • 3.0.8
    • 3.0.9
    Affected ranges
    • ECOSYSTEM: ≥ 3.0.0, < 3.0.51

    Update to 3.0.51

  • php-phpseclib Ubuntu:Pro:16.04:LTS

    Versions
    • 2.0.1-1
    • 2.0.1-1build1
    Affected ranges
    • ECOSYSTEM: < 2.0.1-1ubuntu0.1~esm1

    Update to 2.0.1-1ubuntu0.1~esm1

  • phpseclib Ubuntu:Pro:16.04:LTS

    Versions
    • 0.3.10-3
    • 1.0.0-2
    • 1.0.0-3
    • 1.0.1-1
    • 1.0.1-3
    • 1.0.1-3ubuntu0.1
    • 1.0.1-3ubuntu0.1+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • php-phpseclib Ubuntu:Pro:18.04:LTS

    Versions
    • 2.0.6-1
    • 2.0.7-1
    • 2.0.9-1
    • 2.0.9-1ubuntu0.1~esm2
    Affected ranges
    • ECOSYSTEM: < 2.0.9-1ubuntu0.1~esm3

    Update to 2.0.9-1ubuntu0.1~esm3

  • phpseclib Ubuntu:Pro:18.04:LTS

    Versions
    • 1.0.7-1
    • 1.0.8-1
    • 1.0.9-1
    • 1.0.9-1ubuntu0.1~esm1
    • 1.0.9-1ubuntu0.1~esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • php-phpseclib Ubuntu:Pro:20.04:LTS

    Versions
    • 2.0.21-2
    • 2.0.23-2
    • 2.0.23-2ubuntu0.1~esm2
    Affected ranges
    • ECOSYSTEM: < 2.0.23-2ubuntu0.1~esm3

    Update to 2.0.23-2ubuntu0.1~esm3

  • phpseclib Ubuntu:Pro:20.04:LTS

    Versions
    • 1.0.16-2
    • 1.0.18-2
    • 1.0.18-2ubuntu0.1~esm1
    • 1.0.18-2ubuntu0.1~esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • php-phpseclib Ubuntu:Pro:22.04:LTS

    Versions
    • 2.0.30-2ubuntu1
    • 2.0.34-1
    • 2.0.35-1
    • 2.0.36-1
    • 2.0.36-1ubuntu0.1~esm2
    Affected ranges
    • ECOSYSTEM: < 2.0.36-1ubuntu0.1~esm3

    Update to 2.0.36-1ubuntu0.1~esm3

  • php-phpseclib3 Ubuntu:Pro:22.04:LTS

    Versions
    • 3.0.9-1
    • 3.0.10-1
    • 3.0.12-2
    • 3.0.13-1
    • 3.0.13-1ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • phpseclib Ubuntu:22.04:LTS

    Versions
    • 1.0.19-3ubuntu2
    • 1.0.19-3ubuntu3
    • 1.0.20-1
    • 1.0.20-1ubuntu0.1~esm1
    • 1.0.20-1+deb12u3build0.22.04.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • php-phpseclib3 Ubuntu:24.04:LTS

    Versions
    • 3.0.21-2
    • 3.0.33-1
    • 3.0.34-1
    • 3.0.35-1
    • 3.0.37-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • php-phpseclib Ubuntu:Pro:24.04:LTS

    Versions
    • 2.0.44-1
    • 2.0.45-1
    • 2.0.46-1
    • 2.0.47-1
    Affected ranges
    • ECOSYSTEM: < 2.0.47-1ubuntu0.1~esm1

    Update to 2.0.47-1ubuntu0.1~esm1

  • phpseclib Ubuntu:Pro:24.04:LTS

    Versions
    • 1.0.21-2
    • 1.0.22-1
    • 1.0.23-1
    • 1.0.23-1ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →