Skip to content
OpenAdvisories
High DSA-6185-1 1 CVE

phpseclib - security update

Published Mar 29, 2026 · Updated Mar 29, 2026

Ecosystem: Debian

Fixed packages 2

ReleasePackageFixed in
Debian · 12 phpseclib 1.0.20-1+deb12u3
Debian · 13 phpseclib 1.0.23-6+deb13u1

Vulnerabilities 1

  • High 8.2
    CVE-2026-32935

    phpseclib's AES-CBC unpadding susceptible to padding oracle timing attack

    phpseclib is a PHP secure communications library. Projects using versions 0.1.1 through 1.0.26, 2.0.0 through 2.0.51, and 3.0.0 through 3.0.49 are vulnerable to a to padding oracle timing attack when using AES in CBC mode. This issue has been fixed in version…

    phpseclib phpseclib nextcloud-server-33 php-phpseclib3 Debian Ubuntu Wolfi Packagist