VulnerableCode Package Details - pkg:composer/phpseclib/phpseclib@2.0.22

Search for packages

Vulnerability	Summary	Fixed by
VCID-6xjw-f9xu-fkg8 Aliases: CVE-2024-27354 GHSA-hg35-mp25-qf6h	phpseclib a large prime can cause a denial of service An issue was discovered in phpseclib 1.x before 1.0.23, 2.x before 2.0.47, and 3.x before 3.0.36. An attacker can construct a malformed certificate containing an extremely large prime to cause a denial of service (CPU consumption for an isPrime primality check). NOTE: this issue was introduced when attempting to fix CVE-2023-27560.	2.0.47 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 3.0.36 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-8h2u-szq5-13ar Aliases: CVE-2023-52892 GHSA-ff7q-6vwh-v9m4	Name confusion in x509 Subject Alternative Name fields In phpseclib before 1.0.22, 2.x before 2.0.46, and 3.x before 3.0.33, some characters in Subject Alternative Name fields in TLS certificates are incorrectly allowed to have a special meaning in regular expressions (such as a + wildcard), leading to name confusion in X.509 certificate host verification.	2.0.46 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 3.0.33 Affected by 4 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-ars3-xpyv-jbf1 Aliases: CVE-2024-27355 GHSA-jr22-8qgm-4q87	phpseclib does not properly limit the ASN1 OID length An issue was discovered in phpseclib 1.x before 1.0.23, 2.x before 2.0.47, and 3.x before 3.0.36. When processing the ASN.1 object identifier of a certificate, a sub identifier may be provided that leads to a denial of service (CPU consumption for decodeOID).	2.0.47 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 3.0.36 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-ku5e-5j7s-qyc9 Aliases: CVE-2026-32935 GHSA-94g3-g5v7-q4jg	phpseclib's AES-CBC unpadding susceptible to padding oracle timing attack ### Impact Those using AES in CBC mode may be susceptible to a padding oracle timing attack. ### Patches https://github.com/phpseclib/phpseclib/commit/ccc21aef71eb170e9bf819b167e67d1fd9e6e788 ### Workarounds Use AES in CTR, CFB or OFB modes	2.0.52 Affected by 0 other vulnerabilities. 3.0.50 Affected by 0 other vulnerabilities.
VCID-ndjx-6ned-93bd Aliases: CVE-2021-30130 GHSA-vf4w-fg7r-5v94	Improper Certificate Validation in phpseclib phpseclib before 2.0.31 and 3.x before 3.0.7 mishandles RSA PKCS#1 v1.5 signature verification.	2.0.31 Affected by 4 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 3.0.7 Affected by 6 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}

Vulnerability

Summary

Fixed by

VCID-6xjw-f9xu-fkg8
Aliases:
CVE-2024-27354
GHSA-hg35-mp25-qf6h

phpseclib a large prime can cause a denial of service An issue was discovered in phpseclib 1.x before 1.0.23, 2.x before 2.0.47, and 3.x before 3.0.36. An attacker can construct a malformed certificate containing an extremely large prime to cause a denial of service (CPU consumption for an isPrime primality check). NOTE: this issue was introduced when attempting to fix CVE-2023-27560.

2.0.47
Affected by 1 other vulnerability.

3.0.36
Affected by 1 other vulnerability.

VCID-8h2u-szq5-13ar
Aliases:
CVE-2023-52892
GHSA-ff7q-6vwh-v9m4

Name confusion in x509 Subject Alternative Name fields In phpseclib before 1.0.22, 2.x before 2.0.46, and 3.x before 3.0.33, some characters in Subject Alternative Name fields in TLS certificates are incorrectly allowed to have a special meaning in regular expressions (such as a + wildcard), leading to name confusion in X.509 certificate host verification.

2.0.46
Affected by 3 other vulnerabilities.

3.0.33
Affected by 4 other vulnerabilities.

VCID-ars3-xpyv-jbf1
Aliases:
CVE-2024-27355
GHSA-jr22-8qgm-4q87

phpseclib does not properly limit the ASN1 OID length An issue was discovered in phpseclib 1.x before 1.0.23, 2.x before 2.0.47, and 3.x before 3.0.36. When processing the ASN.1 object identifier of a certificate, a sub identifier may be provided that leads to a denial of service (CPU consumption for decodeOID).

2.0.47
Affected by 1 other vulnerability.

3.0.36
Affected by 1 other vulnerability.

VCID-ku5e-5j7s-qyc9
Aliases:
CVE-2026-32935
GHSA-94g3-g5v7-q4jg

phpseclib's AES-CBC unpadding susceptible to padding oracle timing attack ### Impact Those using AES in CBC mode may be susceptible to a padding oracle timing attack. ### Patches https://github.com/phpseclib/phpseclib/commit/ccc21aef71eb170e9bf819b167e67d1fd9e6e788 ### Workarounds Use AES in CTR, CFB or OFB modes

2.0.52
Affected by 0 other vulnerabilities.

3.0.50
Affected by 0 other vulnerabilities.

VCID-ndjx-6ned-93bd
Aliases:
CVE-2021-30130
GHSA-vf4w-fg7r-5v94

Improper Certificate Validation in phpseclib phpseclib before 2.0.31 and 3.x before 3.0.7 mishandles RSA PKCS#1 v1.5 signature verification.

2.0.31
Affected by 4 other vulnerabilities.

3.0.7
Affected by 6 other vulnerabilities.

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Vulnerability

Summary

Aliases

This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-04-22T07:35:14.555312+00:00	GitLab Importer	Affected by	VCID-ku5e-5j7s-qyc9	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/phpseclib/phpseclib/CVE-2026-32935.yml	38.4.0
2026-04-16T23:03:22.258662+00:00	GitLab Importer	Affected by	VCID-8h2u-szq5-13ar	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/phpseclib/phpseclib/CVE-2023-52892.yml	38.4.0
2026-04-16T22:53:14.600168+00:00	GitLab Importer	Affected by	VCID-6xjw-f9xu-fkg8	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/phpseclib/phpseclib/CVE-2024-27354.yml	38.4.0
2026-04-16T22:53:14.115041+00:00	GitLab Importer	Affected by	VCID-ars3-xpyv-jbf1	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/phpseclib/phpseclib/CVE-2024-27355.yml	38.4.0
2026-04-16T21:20:10.378507+00:00	GitLab Importer	Affected by	VCID-ndjx-6ned-93bd	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/phpseclib/phpseclib/CVE-2021-30130.yml	38.4.0
2026-04-16T03:00:43.129297+00:00	GHSA Importer	Affected by	VCID-6xjw-f9xu-fkg8	https://github.com/advisories/GHSA-hg35-mp25-qf6h	38.4.0
2026-04-16T03:00:42.655990+00:00	GHSA Importer	Affected by	VCID-ars3-xpyv-jbf1	https://github.com/advisories/GHSA-jr22-8qgm-4q87	38.4.0
2026-04-12T00:21:13.962589+00:00	GitLab Importer	Affected by	VCID-8h2u-szq5-13ar	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/phpseclib/phpseclib/CVE-2023-52892.yml	38.3.0
2026-04-12T00:11:36.570963+00:00	GitLab Importer	Affected by	VCID-6xjw-f9xu-fkg8	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/phpseclib/phpseclib/CVE-2024-27354.yml	38.3.0
2026-04-12T00:11:36.025005+00:00	GitLab Importer	Affected by	VCID-ars3-xpyv-jbf1	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/phpseclib/phpseclib/CVE-2024-27355.yml	38.3.0
2026-04-11T22:32:30.734570+00:00	GitLab Importer	Affected by	VCID-ndjx-6ned-93bd	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/phpseclib/phpseclib/CVE-2021-30130.yml	38.3.0
2026-04-11T14:29:16.749110+00:00	GHSA Importer	Affected by	VCID-6xjw-f9xu-fkg8	https://github.com/advisories/GHSA-hg35-mp25-qf6h	38.3.0
2026-04-11T14:29:16.236795+00:00	GHSA Importer	Affected by	VCID-ars3-xpyv-jbf1	https://github.com/advisories/GHSA-jr22-8qgm-4q87	38.3.0
2026-04-03T00:28:46.344972+00:00	GitLab Importer	Affected by	VCID-8h2u-szq5-13ar	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/phpseclib/phpseclib/CVE-2023-52892.yml	38.1.0
2026-04-03T00:17:58.056925+00:00	GitLab Importer	Affected by	VCID-6xjw-f9xu-fkg8	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/phpseclib/phpseclib/CVE-2024-27354.yml	38.1.0
2026-04-03T00:17:57.589306+00:00	GitLab Importer	Affected by	VCID-ars3-xpyv-jbf1	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/phpseclib/phpseclib/CVE-2024-27355.yml	38.1.0
2026-04-02T22:43:45.289490+00:00	GitLab Importer	Affected by	VCID-ndjx-6ned-93bd	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/phpseclib/phpseclib/CVE-2021-30130.yml	38.1.0
2026-04-02T15:10:15.775626+00:00	GHSA Importer	Affected by	VCID-6xjw-f9xu-fkg8	https://github.com/advisories/GHSA-hg35-mp25-qf6h	38.1.0
2026-04-02T15:10:15.276290+00:00	GHSA Importer	Affected by	VCID-ars3-xpyv-jbf1	https://github.com/advisories/GHSA-jr22-8qgm-4q87	38.1.0
2026-04-01T17:01:31.875886+00:00	GitLab Importer	Affected by	VCID-ndjx-6ned-93bd	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/phpseclib/phpseclib/CVE-2021-30130.yml	38.0.0