CVE-2026-32935

EUVD-2026-13507
phpseclib is a PHP secure communications library. Projects using versions 1.0.26 and below, 2.0.0 through 2.0.51, and 3.0.0 through 3.0.49 are vulnerable to a to padding oracle timing attack when using AES in CBC mode. This issue has been fixed in versions 1.0.27, 2.0.52 and 3.0.50.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.9 MEDIUM
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Affected Products (NVD)
VendorProductVersion
phpseclibphpseclib
𝑥
< 1.0.27
phpseclibphpseclib
2.0.0 ≤
𝑥
< 2.0.52
phpseclibphpseclib
3.0.0 ≤
𝑥
< 3.0.50
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
php-phpseclib
bookworm
vulnerable
bookworm (security)
vulnerable
bullseye
vulnerable
bullseye (security)
vulnerable
forky
2.0.52-1
fixed
sid
2.0.52-1
fixed
trixie
vulnerable
php-phpseclib3
bookworm
vulnerable
bookworm (security)
vulnerable
forky
3.0.50-1
fixed
sid
3.0.50-1
fixed
trixie
vulnerable
phpseclib
bookworm
vulnerable
bookworm (security)
vulnerable
bullseye
vulnerable
bullseye (security)
vulnerable
sid
1.0.27-1
fixed
trixie
vulnerable
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
php-phpseclib
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
questing
needs-triage
xenial
needs-triage
php-phpseclib3
jammy
needs-triage
noble
needs-triage
questing
needs-triage
phpseclib
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
questing
needs-triage
xenial
needs-triage