What is the CVSS score of CVE-2026-32313?

CVE-2026-32313 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-32313?

CVE-2026-32313 is a high-severity cryptographic vulnerability in the widely-used xmlseclibs PHP library that allows unauthenticated attackers to decrypt sensitive XML data and forge encrypted…. A patch is available.

How to fix or mitigate CVE-2026-32313?

Within 24 hours: Inventory all systems using xmlseclibs PHP library (versions before 3.1.5) and assess exposure; implement network segmentation to limit external access to affected services. Within 7 days: Contact vendor for patched version 3.1.5 or later; establish temporary WAF rules to block suspicious XML encryption requests; conduct threat hunt for signs of exploitation. Within 30 days: Apply vendor patch to all affected systems; rotate encryption keys and re-validate integrity of previously encrypted data; conduct post-incident review of access logs.

PHP CVE-2026-32313

EUVD-2026-12094 HIGH

Improper Validation of Integrity Check Value (CWE-354)

2026-03-13 GitHub_M

GHSA-4v26-v6cg-g6f9

PHP Information Disclosure Xmlseclibs

8.2

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 13, 2026 - 21:01 euvd

EUVD-2026-12094

Analysis Generated

Mar 13, 2026 - 21:01 vuln.today

CVE Published

Mar 13, 2026 - 19:50 nvd

HIGH 8.2

DescriptionGitHub Advisory

xmlseclibs is a library written in PHP for working with XML Encryption and Signatures. Prior to 3.1.5, XML nodes encrypted with either aes-128-gcm, aes-192-gcm, or aes-256-gcm lack validation of the authentication tag length. An attacker can use this to brute-force an authentication tag, recover the GHASH key, and decrypt the encrypted nodes. It also allows to forge arbitrary ciphertexts without knowing the encryption key. This vulnerability is fixed in 3.1.5.

AnalysisAI

Critical cryptographic vulnerability in the xmlseclibs PHP library (versions before 3.1.5) that fails to validate authentication tag lengths in AES-GCM encrypted XML nodes. Attackers can exploit this remotely without authentication to brute-force encryption keys, decrypt sensitive data, and forge ciphertexts. While not currently in CISA's KEV catalog, the vulnerability has a high CVSS score of 8.2 and affects a widely-used XML security library.

Technical ContextAI

The xmlseclibs library (CPE: cpe:2.3:a:robrichards:xmlseclibs:*:*:*:*:*:*:*:*) is a PHP implementation for XML Encryption and XML Signatures standards. The vulnerability stems from CWE-354 (Improper Validation of Integrity Check Value), specifically affecting AES Galois/Counter Mode (GCM) implementations for 128, 192, and 256-bit key sizes. GCM mode relies on authentication tags to ensure data integrity and authenticity, but the library fails to validate the tag length, allowing truncated tags that can be brute-forced to recover the GHASH authentication key used in GCM's polynomial MAC construction.

RemediationAI

Upgrade to xmlseclibs version 3.1.5 or later immediately. The fix is available via commit 03062be78178cbb5e8f605cd255dc32a14981f92. For composer-based PHP projects, update the dependency to "robrichards/xmlseclibs": "^3.1.5". If immediate patching is not possible, consider temporarily disabling AES-GCM modes in favor of other encryption algorithms, though this may require application changes. Review the official release notes at https://github.com/robrichards/xmlseclibs/releases/tag/3.1.5.