Description
phpseclib before 2.0.31 and 3.x before 3.0.7 mishandles RSA PKCS#1 v1.5 signature verification.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | php-phpseclib | 2.0.30-2 | — |
| Debian 14 | php-phpseclib3 | 3.0.7-1 | — |
| Debian 13 | php-phpseclib | 2.0.30-2 | — |
| Debian 13 | php-phpseclib3 | 3.0.7-1 | — |
| Debian 13 | phpseclib | 1.0.19-3 | — |
| Debian 12 | php-phpseclib | 2.0.30-2 | — |
| Debian 12 | php-phpseclib3 | 3.0.7-1 | — |
| Debian 12 | phpseclib | 1.0.19-3 | — |
| Debian 10 | php-phpseclib | 2.0.30-2~deb10u1 | DLA-3198-1 |
| Debian 10 | phpseclib | 1.0.19-3~deb10u1 | DLA-3197-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 22.04 LTS | php-phpseclib | 2.0.36-1ubuntu0.1~esm2 | USN-7404-1 |
| Ubuntu Pro 22.04 LTS | php-phpseclib3 | 3.0.13-1ubuntu0.1~esm1 | USN-7404-1 |
| Ubuntu Pro 22.04 LTS | phpseclib | 1.0.20-1ubuntu0.1~esm1 | USN-7404-1 |
| Ubuntu Pro 20.04 LTS | php-phpseclib | 2.0.23-2ubuntu0.1~esm2 | USN-7404-1 |
| Ubuntu Pro 20.04 LTS | phpseclib | 1.0.18-2ubuntu0.1~esm1 | USN-7404-1 |
| Ubuntu Pro 18.04 LTS | php-phpseclib | 2.0.9-1ubuntu0.1~esm2 | USN-7404-1 |
| Ubuntu Pro 18.04 LTS | phpseclib | 1.0.9-1ubuntu0.1~esm1 | USN-7404-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | php-phpseclib | 2.0.1-1ubuntu0.1~esm2 | USN-7404-1 |
| Ubuntu Pro 16.04 LTS | phpseclib | 1.0.1-3ubuntu0.1+esm1 | USN-7404-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | phpseclib/phpseclib | >= 3.0.0, < 3.0.7 | 3.0.7 | GHSA-vf4w-fg7r-5v94 |
| Packagist | phpseclib/phpseclib | < 2.0.31 | 2.0.31 | GHSA-vf4w-fg7r-5v94 |
Advisories 3
- USN-7404-1 phpseclib vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
- DLA-3197-1 phpseclib - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-3198-1 php-phpseclib - security update Debian Security (DSA / DLA) · Mar 9, 2026
References
- https://github.com/phpseclib/phpseclib/pull/1635
- https://github.com/phpseclib/phpseclib/releases/tag/3.0.7
- https://github.com/phpseclib/phpseclib/releases/tag/2.0.31
- [debian-lts-announce] 20221117 [SECURITY] [DLA 3197-1] phpseclib security update mailing-list
- [debian-lts-announce] 20221117 [SECURITY] [DLA 3198-1] php-phpseclib security update mailing-list