Composer phpseclib/phpseclib has 11 known advisories in the phpwarden feed. Feed 2026.10.29.1, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2021-30130 | Improper Certificate Validation in phpseclib | high | 7.5 | >=3.0.0 and <3.0.7 or <2.0.31 | 3.0.7, 2.0.31 |
| CVE-2023-27560 | phpseclib Infinite Loop vulnerability | high | 7.5 | >=3.0.0 and <3.0.19 | 3.0.19 |
| CVE-2023-49316 | Phpseclib needs guardrails on large binaryfield integers | high | 7.5 | >=3.0.0 and <3.0.34 | 3.0.34 |
| CVE-2024-27354 | phpseclib: guardrails needed on isPrime and randomPrime | high | 7.5 | >=0.1.1 and <1.0.23 or >=2.0.0 and <2.0.47 or >=3.0.0 and <3.0.36 or >=1.0.0 and <1.0.23 | 1.0.23, 2.0.47, 3.0.36 |
| CVE-2024-27355 | phpseclib guardrails needed on OID length | high | 7.5 | >=2.0.0 and <2.0.47 or >=3.0.0 and <3.0.36 or >=0.1.1 and <1.0.23 or >=1.0.0 and <1.0.23 | 2.0.47, 3.0.36, 1.0.23 |
| CVE-2026-32935 | phpseclib's AES-CBC unpadding susceptible to padding oracle timing attack | high | 0.0 | >=3.0.0 and <3.0.50 or >=2.0.0 and <2.0.52 or >=0.1.1 and <1.0.27 | 3.0.50, 2.0.52, 1.0.27 |
| CVE-2023-52892 | Name confusion in x509 Subject Alternative Name fields | high | 7.5 | <1.0.22 or >=2.0.0 and <2.0.46 or >=3.0.0 and <3.0.33 | 1.0.22, 2.0.46, 3.0.33 |
| CVE-2026-40194 | phpseclib has a variable-time HMAC comparison in SSH2::get_binary_packet() using != instead of hash_equals() | low | 3.7 | >=0.1.1 and <1.0.28 or >=2.0.0 and <2.0.53 or >=3.0.0 and <3.0.51 | 1.0.28, 2.0.53, 3.0.51 |
| CVE-2026-84308 | phpseclib — non-constant-time X25519 scalar multiplication permits full private-key recovery | medium | 6.3 | <3.0.57 or >=4.0.0 and <4.0.1 | 3.0.57, 4.0.1 |
| CVE-2026-55599 | phpseclib: X.509 certificate validation sends attacker-controlled outbound requests (server-side request forgery) via Authority Information | medium | 5.8 | >=0.1.1 and <1.0.30 or >=2.0.0 and <2.0.55 or >=3.0.0 and <3.0.54 | 1.0.30, 2.0.55, 3.0.54 |
| CVE-2026-44167 | phpseclib has a CVE-2024-27355 mitigation bypass — OID amplification DoS in ASN1::decodeOID() | high | 7.5 | >=0.1.1 and <1.0.29 or >=2.0.0 and <2.0.54 or >=3.0.0 and <3.0.52 | 1.0.29, 2.0.54, 3.0.52 |
Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden deps composer.lock
Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command
Install docs How findings are ranked