CVE-2026-32935
EUVD-2026-1350720.03.2026, 03:16
phpseclib is a PHP secure communications library. Projects using versions 1.0.26 and below, 2.0.0 through 2.0.51, and 3.0.0 through 3.0.49 are vulnerable to a to padding oracle timing attack when using AES in CBC mode. This issue has been fixed in versions 1.0.27, 2.0.52 and 3.0.50.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| phpseclib | phpseclib | 𝑥 < 1.0.27 |
| phpseclib | phpseclib | 2.0.0 ≤ 𝑥 < 2.0.52 |
| phpseclib | phpseclib | 3.0.0 ≤ 𝑥 < 3.0.50 |
𝑥
= Vulnerable software versions
Debian Releases
Debian Product | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| php-phpseclib |
| ||||||||||||||
| php-phpseclib3 |
| ||||||||||||||
| phpseclib |
|
Ubuntu Releases
Ubuntu Product | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| php-phpseclib |
| ||||||||||||
| php-phpseclib3 |
| ||||||||||||
| phpseclib |
|