Skip to content
OpenAdvisories

Package · Debian

php-phpseclib

9 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Low 3.7
    CVE-2026-40194

    phpseclib has a variable-time HMAC comparison in SSH2::get_binary_packet() using != instead of hash_equals()

    phpseclib is a PHP secure communications library. Starting in 0.1.1 and prior to 3.0.51, 2.0.53, and 1.0.28, phpseclib\Net\SSH2::get_binary_packet() uses PHP's != operator to compare a received SSH packet HMAC against the locally computed HMAC. != on equal-le…

    phpseclib phpseclib php-phpseclib3 phpseclib/phpseclib Debian Ubuntu Packagist