EUVD-2026-21597
GHSA-r854-jrxh-36qx
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V6 - Authentication Timing attack prevention
|
| Impact | CVSS 3.7 reflects low overall severity: attack requires network access (AV:N), but high complexity (AC:H) due to timing precision requirements, no privilege escalation (PR:N, UI:N), and only low confidentiality impact (C:L). However, CVSS underweights cryptographic timing attacks. EPSS data is not provided, but real-world exploitability is constrained by practical factors: attackers must achieve sub-millisecond timing precision over the network, which is difficult in high-latency or noisy network environments. The attack does not achieve authentication bypass or remote code execution-only gradual disclosure of session HMAC values, which does not directly compromise plaintext if the SSH symmetric ciphers remain unbroken. The lack of confirmed public exploit code (POC=NO) and no CISA KEV listing indicate limited active exploitation risk at present. However, the vulnerability is definitively real: the GitHub commit and academic literature on timing attacks validate the threat. For organizations using phpseclib in performance-critical SSH scenarios with untrusted network positions, patching is justified; for typical LAN or VPN-protected deployments, risk is minimal. |
| Exploit ScenarioDerived | An attacker on a network path between a PHP application using phpseclib and an SSH server (or controlling the SSH server) can measure SSH packet response times to the application. By crafting SSH packets with incrementally modified HMAC values and observing which variants produce longer response times, the attacker can deduce the correct HMAC one byte at a time. After inferring the session HMAC, the attacker gains information about the symmetric session key derivation but cannot directly decrypt past traffic without breaking the underlying cipher. The attack requires high-precision timing (microsecond-level), favoring local or LAN attackers or those with sophisticated network measurement tools; internet-scale attacks are impractical. No public exploit code is available, limiting risk from unsophisticated threat actors. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 10, 2026
phpseclib's SSH2 packet authentication uses PHP's non-constant-time != operator to compare HMACs, enabling timing-based information disclosure attacks on SSH sessions. The vulnerability affects phpseclib versions prior to 1.0.28, 2.0.53, and 3.0.51. An unauthenticated remote attacker can exploit variable-time comparison behavior to infer valid HMAC values through precise timing measurements, potentially compromising the confidentiality of SSH communications. No public exploit code or active exploitation has been confirmed, but this is a cryptographic timing vulnerability with proven scalability via benchmarking.
RemediationAI
Vendor-released patches are available: upgrade to phpseclib 1.0.28 or later, 2.0.53 or later, or 3.0.51 or later, depending on the current major version in use. Apply the patch immediately if phpseclib is used in SSH connections across untrusted networks or where attackers may control network latency measurements. Workarounds are not practical for this cryptographic issue; patching is required. Refer to the official security advisory at https://github.com/phpseclib/phpseclib/security/advisories/GHSA-r854-jrxh-36qx and verify the patched release via https://github.com/phpseclib/phpseclib/releases (tags 1.0.28, 2.0.53, and 3.0.51). The underlying fix (commit ffe48b6b1b1af6963327f0a5330e3aa004a194ac) replaces the != operator with hash_equals(), a constant-time comparison function.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in composer, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
phpseclib implements SSH protocol functionality via the Net\SSH2 class, which validates packet integrity using HMAC-based authentication codes. The vulnerability resides in the get_binary_packet() method, which employs PHP's != operator for HMAC comparison. In PHP, the != operator on binary strings of equal length internally uses the C memcmp() function, which performs byte-by-byte comparison and exits immediately upon finding the first differing byte. This short-circuit behavior creates a measurable timing side-channel (CWE-208: Observable Timing Discrepancy): valid HMACs require memcmp() to compare all bytes before returning false, while invalid HMACs with differing early bytes return faster. By measuring response latency across many SSH packets with systematically varied HMACs, an attacker can narrow the valid HMAC byte-by-byte, reducing computational complexity from 2^(HMAC_length) to roughly 256 * HMAC_length attempts. The affected CPE (cpe:2.3:a:phpseclib:phpseclib) spans all installations prior to the patched releases.
Know when Phpseclib gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
phpseclib is a PHP secure communications library. Prior to 3.0.51, 2.0.53, and 1.0.28, phpseclib\Net\SSH2::get_binary_packet() uses PHP's != operator to compare a received SSH packet HMAC against the locally computed HMAC. != on equal-length binary strings in PHP uses memcmp(), which short-circuits on the first differing byte. This is a real variable-time comparison (CWE-208), proven by scaling benchmarks. This vulnerability is fixed in 3.0.51, 2.0.53, and 1.0.28.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Timing side-channel exposure in phpseclib's pure-PHP X25519 scalar multiplication allows a local observer to recover a r
phpseclib versions 1.0.26 and below, 2.0.0 through 2.0.51, and 3.0.0 through 3.0.49 are vulnerable to a padding oracle t
Math/PrimeField.php in phpseclib 3.x before 3.0.19 has an infinite loop with composite primefields. Rated high severity
phpseclib before 2.0.31 and 3.x before 3.0.7 mishandles RSA PKCS#1 v1.5 signature verification. Rated high severity (CVS
Server-side request forgery in phpseclib's X.509 validation allows unauthenticated network attackers to force the valida
Exploit-DB