Description
An issue was discovered in phpseclib 1.x before 1.0.23, 2.x before 2.0.47, and 3.x before 3.0.36. When processing the ASN.1 object identifier of a certificate, a sub identifier may be provided that leads to a denial of service (CPU consumption for decodeOID).
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | php-phpseclib | 2.0.47-1 | — |
| Debian 14 | php-phpseclib3 | 3.0.36-1 | — |
| Debian 13 | php-phpseclib | 2.0.47-1 | — |
| Debian 13 | php-phpseclib3 | 3.0.36-1 | — |
| Debian 13 | phpseclib | 1.0.23-1 | — |
| Debian 12 | php-phpseclib | 2.0.42-1+deb12u2 | — |
| Debian 12 | php-phpseclib3 | 3.0.19-1+deb12u3 | — |
| Debian 12 | phpseclib | 1.0.20-1+deb12u2 | — |
| Debian 10 | php-phpseclib | 2.0.30-2~deb10u3 | DLA-3750-1 |
| Debian 10 | phpseclib | 1.0.19-3~deb10u3 | DLA-3749-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | phpseclib | 1.0.20-1+deb12u3build0.22.04.1 | USN-8769-1 |
Show 6 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 26.04 LTS | phpseclib | 1.0.24-1ubuntu0.1~esm1 | USN-8769-1 |
| Ubuntu Pro 24.04 LTS | phpseclib | 1.0.23-1ubuntu0.1~esm1 | USN-8769-1 |
| Ubuntu Pro 22.04 LTS | php-phpseclib | 2.0.36-1ubuntu0.1~esm2 | USN-7404-1 |
| Ubuntu Pro 22.04 LTS | php-phpseclib3 | 3.0.13-1ubuntu0.1~esm1 | USN-7404-1 |
| Ubuntu Pro 22.04 LTS | phpseclib | 1.0.20-1ubuntu0.1~esm1 | USN-7404-1 |
| Ubuntu Pro 20.04 LTS | php-phpseclib | 2.0.23-2ubuntu0.1~esm2 | USN-7404-1 |
| Ubuntu Pro 20.04 LTS | phpseclib | 1.0.18-2ubuntu0.1~esm1 | USN-8769-1, USN-7404-1 |
| Ubuntu Pro 18.04 LTS | php-phpseclib | 2.0.9-1ubuntu0.1~esm2 | USN-7404-1 |
| Ubuntu Pro 18.04 LTS | phpseclib | 1.0.9-1ubuntu0.1~esm1 | USN-8769-1, USN-7404-1 |
| Ubuntu Pro 16.04 LTS | php-phpseclib | 2.0.1-1ubuntu0.1~esm2 | USN-7404-1 |
| Ubuntu Pro 16.04 LTS | phpseclib | 1.0.1-3ubuntu0.1+esm1 | USN-8769-1, USN-7404-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | cacti | 1.2.30+git457.e55c2aea-1.1 | openSUSE-SU-2026:10920-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | phpseclib/phpseclib | >= 2.0.0, < 2.0.47 | 2.0.47 | GHSA-f2qx-66wf-wvvx |
| Packagist | phpseclib/phpseclib | >= 3.0.0, < 3.0.36 | 3.0.36 | GHSA-f2qx-66wf-wvvx |
| Packagist | phpseclib/phpseclib | >= 0.1.1, < 1.0.23 | 1.0.23 | GHSA-f2qx-66wf-wvvx |
Advisories 5
- USN-8769-1 phpseclib vulnerability Ubuntu Security Notices (USN) · Sep 16, 2026
- USN-7404-1 phpseclib vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
- openSUSE-SU-2026:10920-1 cacti-1.2.30+git457.e55c2aea-1.1 on GA media SUSE / openSUSE Security Updates · Jun 2, 2026
- DLA-3750-1 php-phpseclib - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-3749-1 phpseclib - security update Debian Security (DSA / DLA) · Mar 9, 2026
References
- https://github.com/phpseclib/phpseclib/blob/978d081fe50ff92879c50ff143c62a143edb0117/phpseclib/File/ASN1.php#L1129
- https://gist.github.com/katzj/ee72f3c2a00590812b2ea3c0c8890e0b
- [debian-lts-announce] 20240305 [SECURITY] [DLA 3749-1] phpseclib security update mailing-list
- [debian-lts-announce] 20240305 [SECURITY] [DLA 3750-1] php-phpseclib security update mailing-list