p PatchFirst

CVE-2026-44167

CVE-2026-44167 · phpseclib: CVE-2024-27355 mitigation bypass — OID amplification DoS in ASN1::decodeOID()

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

phpseclib is a PHP secure communications library. Prior to 1.0.29, 2.0.54, and 3.0.52, anyone loading untrusted ASN1 files (eg. X509 certificates, RSA PKCS8 private or public keys, etc). This is a bypass of CVE-2024-27355. This vulnerability is fixed in 1.0.29, 2.0.54, and 3.0.52.

CVSS 7.5 · High · EPSS 0.2% · Fix available

Published
Updated

Stack: system · php

Affected products and versions

  • phpseclib

    Versions
    • >= 3.0.0, < 3.0.52: Affected
    • >= 2.0.0, < 2.0.54: Affected
    • >= 0.1.1, < 1.0.29: Affected

    No fix published

  • php-phpseclib Debian:12

    Versions
    • 2.0.42-1
    • 2.0.42-1+deb12u1
    • 2.0.42-1+deb12u2
    • 2.0.42-1+deb12u3
    Affected ranges
    • ECOSYSTEM: < 2.0.42-1+deb12u5

    Update to 2.0.42-1+deb12u5

  • php-phpseclib Debian:13

    Versions
    • 2.0.48-3
    • 2.0.48-3+deb13u1
    Affected ranges
    • ECOSYSTEM: < 2.0.48-3+deb13u3

    Update to 2.0.48-3+deb13u3

  • php-phpseclib Debian:14

    Versions
    • 2.0.48-3
    • 2.0.49-1
    • 2.0.50-1
    • 2.0.51-1
    • 2.0.52-1
    • 2.0.53-1
    Affected ranges
    • ECOSYSTEM: < 2.0.54-1

    Update to 2.0.54-1

  • php-phpseclib3 Debian:12

    Versions
    • 3.0.19-1
    • 3.0.19-1+deb12u1
    • 3.0.19-1+deb12u2
    • 3.0.19-1+deb12u3
    • 3.0.19-1+deb12u4
    Affected ranges
    • ECOSYSTEM: < 3.0.19-1+deb12u6

    Update to 3.0.19-1+deb12u6

  • php-phpseclib3 Debian:13

    Versions
    • 3.0.43-2
    • 3.0.43-2+deb13u1
    Affected ranges
    • ECOSYSTEM: < 3.0.43-2+deb13u3

    Update to 3.0.43-2+deb13u3

  • php-phpseclib3 Debian:14

    Versions
    • 3.0.43-2
    • 3.0.44-1
    • 3.0.44-2
    • 3.0.45-1
    • 3.0.46-1
    • 3.0.46-2
    • 3.0.47-1
    • 3.0.48-1
    • 3.0.49-1
    • 3.0.50-1
    • 3.0.51-1
    Affected ranges
    • ECOSYSTEM: < 3.0.52-1

    Update to 3.0.52-1

  • phpseclib Debian:12

    Versions
    • 1.0.20-1
    • 1.0.20-1+deb12u1
    • 1.0.20-1+deb12u2
    • 1.0.20-1+deb12u3
    Affected ranges
    • ECOSYSTEM: < 1.0.20-1+deb12u5

    Update to 1.0.20-1+deb12u5

  • phpseclib Debian:13

    Versions
    • 1.0.23-6
    • 1.0.23-6+deb13u1
    Affected ranges
    • ECOSYSTEM: < 1.0.23-6+deb13u3

    Update to 1.0.23-6+deb13u3

  • phpseclib/phpseclib Packagist

    Versions
    • 0.3.0
    • 0.3.1
    • 0.3.10
    • 0.3.5
    • 0.3.6
    • 0.3.7
    • 0.3.8
    • 0.3.9
    • 1.0.0
    • 1.0.1
    • 1.0.10
    • 1.0.11
    • 1.0.12
    • 1.0.13
    • 1.0.14
    • 1.0.15
    • 1.0.16
    • 1.0.17
    • 1.0.18
    • 1.0.19
    • 1.0.2
    • 1.0.20
    • 1.0.21
    • 1.0.22
    • 1.0.23
    • 1.0.24
    • 1.0.25
    • 1.0.26
    • 1.0.27
    • 1.0.28
    • 1.0.3
    • 1.0.4
    • 1.0.5
    • 1.0.6
    • 1.0.7
    • 1.0.8
    • 1.0.9
    Affected ranges
    • ECOSYSTEM: ≥ 0.1.1, < 1.0.29

    Update to 1.0.29

  • phpseclib/phpseclib Packagist

    Versions
    • 2.0.0
    • 2.0.1
    • 2.0.10
    • 2.0.11
    • 2.0.12
    • 2.0.13
    • 2.0.14
    • 2.0.15
    • 2.0.16
    • 2.0.17
    • 2.0.18
    • 2.0.19
    • 2.0.2
    • 2.0.20
    • 2.0.21
    • 2.0.22
    • 2.0.23
    • 2.0.24
    • 2.0.25
    • 2.0.26
    • 2.0.27
    • 2.0.28
    • 2.0.29
    • 2.0.3
    • 2.0.30
    • 2.0.31
    • 2.0.32
    • 2.0.33
    • 2.0.34
    • 2.0.35
    • 2.0.36
    • 2.0.37
    • 2.0.38
    • 2.0.39
    • 2.0.4
    • 2.0.40
    • 2.0.41
    • 2.0.42
    • 2.0.43
    • 2.0.44
    • 2.0.45
    • 2.0.46
    • 2.0.47
    • 2.0.48
    • 2.0.49
    • 2.0.5
    • 2.0.50
    • 2.0.51
    • 2.0.52
    • 2.0.53
    • 2.0.6
    • 2.0.7
    • 2.0.8
    • 2.0.9
    Affected ranges
    • ECOSYSTEM: ≥ 2.0.0, < 2.0.54

    Update to 2.0.54

  • phpseclib/phpseclib Packagist

    Versions
    • 3.0.0
    • 3.0.1
    • 3.0.10
    • 3.0.11
    • 3.0.12
    • 3.0.13
    • 3.0.14
    • 3.0.15
    • 3.0.16
    • 3.0.17
    • 3.0.18
    • 3.0.19
    • 3.0.2
    • 3.0.20
    • 3.0.21
    • 3.0.22
    • 3.0.23
    • 3.0.3
    • 3.0.33
    • 3.0.34
    • 3.0.35
    • 3.0.36
    • 3.0.37
    • 3.0.38
    • 3.0.39
    • 3.0.4
    • 3.0.40
    • 3.0.41
    • 3.0.42
    • 3.0.43
    • 3.0.44
    • 3.0.45
    • 3.0.46
    • 3.0.47
    • 3.0.48
    • 3.0.49
    • 3.0.5
    • 3.0.50
    • 3.0.51
    • 3.0.6
    • 3.0.7
    • 3.0.8
    • 3.0.9
    Affected ranges
    • ECOSYSTEM: ≥ 3.0.0, < 3.0.52

    Update to 3.0.52

  • php-phpseclib Ubuntu:Pro:16.04:LTS

    Versions
    • 2.0.1-1
    • 2.0.1-1build1
    Affected ranges
    • ECOSYSTEM: < 2.0.1-1ubuntu0.1~esm1

    Update to 2.0.1-1ubuntu0.1~esm1

  • phpseclib Ubuntu:Pro:16.04:LTS

    Versions
    • 0.3.10-3
    • 1.0.0-2
    • 1.0.0-3
    • 1.0.1-1
    • 1.0.1-3
    • 1.0.1-3ubuntu0.1
    • 1.0.1-3ubuntu0.1+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • php-phpseclib Ubuntu:Pro:18.04:LTS

    Versions
    • 2.0.6-1
    • 2.0.7-1
    • 2.0.9-1
    • 2.0.9-1ubuntu0.1~esm2
    Affected ranges
    • ECOSYSTEM: < 2.0.9-1ubuntu0.1~esm3

    Update to 2.0.9-1ubuntu0.1~esm3

  • phpseclib Ubuntu:Pro:18.04:LTS

    Versions
    • 1.0.7-1
    • 1.0.8-1
    • 1.0.9-1
    • 1.0.9-1ubuntu0.1~esm1
    • 1.0.9-1ubuntu0.1~esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • php-phpseclib Ubuntu:Pro:20.04:LTS

    Versions
    • 2.0.21-2
    • 2.0.23-2
    • 2.0.23-2ubuntu0.1~esm2
    Affected ranges
    • ECOSYSTEM: < 2.0.23-2ubuntu0.1~esm3

    Update to 2.0.23-2ubuntu0.1~esm3

  • phpseclib Ubuntu:Pro:20.04:LTS

    Versions
    • 1.0.16-2
    • 1.0.18-2
    • 1.0.18-2ubuntu0.1~esm1
    • 1.0.18-2ubuntu0.1~esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • php-phpseclib Ubuntu:Pro:22.04:LTS

    Versions
    • 2.0.30-2ubuntu1
    • 2.0.34-1
    • 2.0.35-1
    • 2.0.36-1
    • 2.0.36-1ubuntu0.1~esm2
    Affected ranges
    • ECOSYSTEM: < 2.0.36-1ubuntu0.1~esm3

    Update to 2.0.36-1ubuntu0.1~esm3

  • php-phpseclib3 Ubuntu:Pro:22.04:LTS

    Versions
    • 3.0.9-1
    • 3.0.10-1
    • 3.0.12-2
    • 3.0.13-1
    • 3.0.13-1ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • phpseclib Ubuntu:22.04:LTS

    Versions
    • 1.0.19-3ubuntu2
    • 1.0.19-3ubuntu3
    • 1.0.20-1
    • 1.0.20-1ubuntu0.1~esm1
    • 1.0.20-1+deb12u3build0.22.04.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • php-phpseclib3 Ubuntu:24.04:LTS

    Versions
    • 3.0.21-2
    • 3.0.33-1
    • 3.0.34-1
    • 3.0.35-1
    • 3.0.37-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • php-phpseclib Ubuntu:Pro:24.04:LTS

    Versions
    • 2.0.44-1
    • 2.0.45-1
    • 2.0.46-1
    • 2.0.47-1
    Affected ranges
    • ECOSYSTEM: < 2.0.47-1ubuntu0.1~esm1

    Update to 2.0.47-1ubuntu0.1~esm1

  • phpseclib Ubuntu:Pro:24.04:LTS

    Versions
    • 1.0.21-2
    • 1.0.22-1
    • 1.0.23-1
    • 1.0.23-1ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →