Skip to content
OpenAdvisories
High DSA-6187-1 1 CVE

php-phpseclib3 - security update

Published Mar 29, 2026 · Updated Mar 29, 2026

Ecosystem: Debian

Fixed packages 2

ReleasePackageFixed in
Debian · 12 php-phpseclib3 3.0.19-1+deb12u4
Debian · 13 php-phpseclib3 3.0.43-2+deb13u1

Vulnerabilities 1

  • High 8.2
    CVE-2026-32935

    phpseclib's AES-CBC unpadding susceptible to padding oracle timing attack

    phpseclib is a PHP secure communications library. Projects using versions 0.1.1 through 1.0.26, 2.0.0 through 2.0.51, and 3.0.0 through 3.0.49 are vulnerable to a to padding oracle timing attack when using AES in CBC mode. This issue has been fixed in version…

    phpseclib phpseclib nextcloud-server-33 php-phpseclib3 Debian Ubuntu Wolfi Packagist