Fluid Attacks Database

Description

phpseclib is a PHP secure communications library. Prior to 1.0.29, 2.0.54, and 3.0.52, anyone loading untrusted ASN1 files (eg. X509 certificates, RSA PKCS8 private or public keys, etc). This is a bypass of CVE-2024-27355. This vulnerability is fixed in 1.0.29, 2.0.54, and 3.0.52.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 13	php-phpseclib	=2.0.48-3 \|\| =2.0.48-3+deb13u1 \|\| >=0 <2.0.48-3+deb13u3	2.0.48-3+deb13u3
debian 12	php-phpseclib3	=3.0.19-1 \|\| =3.0.19-1+deb12u1 \|\| =3.0.19-1+deb12u2 \|\| =3.0.19-1+deb12u3 \|\| =3.0.19-1+deb12u4 \|\| >=0 <3.0.19-1+deb12u6	3.0.19-1+deb12u6
packagist	phpseclib/phpseclib	>=0.1.1 <1.0.29 \|\| >=2.0.0 <2.0.54 \|\| >=3.0.0 <3.0.52	1.0.29, 2.0.54, 3.0.52
debian 12	php-phpseclib	=2.0.42-1 \|\| =2.0.42-1+deb12u1 \|\| =2.0.42-1+deb12u2 \|\| =2.0.42-1+deb12u3 \|\| >=0 <2.0.42-1+deb12u5	2.0.42-1+deb12u5
debian 12	phpseclib	=1.0.20-1 \|\| =1.0.20-1+deb12u1 \|\| =1.0.20-1+deb12u2 \|\| =1.0.20-1+deb12u3 \|\| >=0 <1.0.20-1+deb12u5	1.0.20-1+deb12u5
debian 13	php-phpseclib3	=3.0.43-2 \|\| =3.0.43-2+deb13u1 \|\| >=0 <3.0.43-2+deb13u3	3.0.43-2+deb13u3
debian 14	php-phpseclib	=2.0.48-3 \|\| =2.0.49-1 \|\| =2.0.50-1 \|\| =2.0.51-1 \|\| =2.0.52-1 \|\| =2.0.53-1 \|\| >=0 <2.0.54-1	2.0.54-1
debian 14	php-phpseclib3	=3.0.43-2 \|\| =3.0.44-1 \|\| =3.0.44-2 \|\| =3.0.45-1 \|\| =3.0.46-1 \|\| =3.0.46-2 \|\| =3.0.47-1 \|\| =3.0.48-1 \|\| =3.0.49-1 \|\| =3.0.50-1 \|\| =3.0.51-1 \|\| >=0 <3.0.52-1	3.0.52-1
debian 13	phpseclib	=1.0.23-6 \|\| =1.0.23-6+deb13u1 \|\| >=0 <1.0.23-6+deb13u3	1.0.23-6+deb13u3

Aliases

1. CVE-2026-441672. NVD-2026-441673. OSV-DEBIAN-2026-441674. OSV-2026-441675. GHSA-3qpq-r242-jqj76. GCVE-2026-441677. SECURITY-TRACKER-CVE-2026-44167

References

1. https://github.com/phpseclib/phpseclib/security/advisories/GHSA-3qpq-r242-jqj72. https://github.com/phpseclib/phpseclib/commit/d53d2021bcb9f6a04d5d44ec99e6bbef219a71bc

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.