Description
An issue was discovered in phpseclib 1.x before 1.0.23, 2.x before 2.0.47, and 3.x before 3.0.36. An attacker can construct a malformed certificate containing an extremely large prime to cause a denial of service (CPU consumption for an isPrime primality check). NOTE: this issue was introduced when attempting to fix CVE-2023-27560.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | php-phpseclib | 2.0.47-1 | — |
| Debian 14 | php-phpseclib3 | 3.0.36-1 | — |
| Debian 13 | php-phpseclib | 2.0.47-1 | — |
| Debian 13 | php-phpseclib3 | 3.0.36-1 | — |
| Debian 13 | phpseclib | 1.0.23-1 | — |
| Debian 12 | php-phpseclib | 2.0.42-1+deb12u2 | — |
| Debian 12 | php-phpseclib3 | 3.0.19-1+deb12u3 | — |
| Debian 12 | phpseclib | 1.0.20-1+deb12u2 | — |
| Debian 10 | php-phpseclib | 2.0.30-2~deb10u3 | DLA-3750-1 |
| Debian 10 | phpseclib | 1.0.19-3~deb10u3 | DLA-3749-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | phpseclib | 1.0.20-1+deb12u3build0.22.04.1 | USN-8769-1 |
Show 6 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 26.04 LTS | phpseclib | 1.0.24-1ubuntu0.1~esm1 | USN-8769-1 |
| Ubuntu Pro 24.04 LTS | phpseclib | 1.0.23-1ubuntu0.1~esm1 | USN-8769-1 |
| Ubuntu Pro 22.04 LTS | php-phpseclib | 2.0.36-1ubuntu0.1~esm2 | USN-7404-1 |
| Ubuntu Pro 22.04 LTS | php-phpseclib3 | 3.0.13-1ubuntu0.1~esm1 | USN-7404-1 |
| Ubuntu Pro 22.04 LTS | phpseclib | 1.0.20-1ubuntu0.1~esm1 | USN-7404-1 |
| Ubuntu Pro 20.04 LTS | php-phpseclib | 2.0.23-2ubuntu0.1~esm2 | USN-7404-1 |
| Ubuntu Pro 20.04 LTS | phpseclib | 1.0.18-2ubuntu0.1~esm1 | USN-8769-1, USN-7404-1 |
| Ubuntu Pro 18.04 LTS | php-phpseclib | 2.0.9-1ubuntu0.1~esm2 | USN-7404-1 |
| Ubuntu Pro 18.04 LTS | phpseclib | 1.0.9-1ubuntu0.1~esm1 | USN-8769-1, USN-7404-1 |
| Ubuntu Pro 16.04 LTS | php-phpseclib | 2.0.1-1ubuntu0.1~esm2 | USN-7404-1 |
| Ubuntu Pro 16.04 LTS | phpseclib | 1.0.1-3ubuntu0.1+esm1 | USN-8769-1, USN-7404-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | phpseclib/phpseclib | >= 0.1.1, < 1.0.23 | 1.0.23 | GHSA-2528-jw5q-ww88 |
| Packagist | phpseclib/phpseclib | >= 2.0.0, < 2.0.47 | 2.0.47 | GHSA-2528-jw5q-ww88 |
| Packagist | phpseclib/phpseclib | >= 3.0.0, < 3.0.36 | 3.0.36 | GHSA-2528-jw5q-ww88 |
Advisories 4
- USN-8769-1 phpseclib vulnerability Ubuntu Security Notices (USN) · Sep 16, 2026
- USN-7404-1 phpseclib vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
- DLA-3750-1 php-phpseclib - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-3749-1 phpseclib - security update Debian Security (DSA / DLA) · Mar 9, 2026
References
- https://github.com/phpseclib/phpseclib/blob/master/phpseclib/Math/PrimeField.php#L49
- https://gist.github.com/katzj/ee72f3c2a00590812b2ea3c0c8890e0b
- [debian-lts-announce] 20240305 [SECURITY] [DLA 3749-1] phpseclib security update mailing-list
- [debian-lts-announce] 20240305 [SECURITY] [DLA 3750-1] php-phpseclib security update mailing-list