phpseclib CVE-2026-44167

Exploitation requires the target application to use vulnerable phpseclib versions (1.0.11-1.0.28, 2.0.0-2.0.53, or 3.0.0-3.0.51) and accept untrusted ASN.1-encoded input from external sources for processing through phpseclib parsing functions. Specifically, the application must invoke ASN.1 decoding on user-supplied X.509 certificates, PKCS8 keys, or similar cryptographic structures. Applications that only process internally generated or cryptographically verified certificates prior to parsing have reduced exposure. Default phpseclib configurations are vulnerable-no non-default settings required. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication, user interaction, or complex configuration is needed, making this exploitable against any internet-facing endpoint that accepts cryptographic file uploads or API submissions containing ASN.1 data.

Real-world risk is moderate to high for internet-facing PHP applications that process user-supplied cryptographic files. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is remotely exploitable without authentication or user interaction, making it trivially automatable. The High availability impact (A:H) with no confidentiality or integrity impact correctly characterizes this as a pure DoS vulnerability. However, exploitation requires the application to accept and process untrusted ASN.1 data-applications that only handle internally generated or pre-validated certificates have reduced exposure. The fact that this bypasses a previous CVE fix (CVE-2024-27355) suggests sophisticated understanding of ASN.1 amplification techniques, though no public exploit identified at time of analysis. EPSS data not provided, but the combination of low attack complexity, no authentication requirement, and availability of patches across three major version branches indicates this should be prioritized for patching in exposed systems. The absence of KEV listing and public POC suggests exploitation is not yet widespread, but the attack surface (any file upload accepting certificates/keys) is broad in modern web applications.

An attacker crafts a malicious X.509 certificate or PKCS8 key file containing an oversized Object Identifier designed to trigger resource exhaustion when decoded. They submit this file to a PHP web application that uses phpseclib for certificate validation, key import, or PKI operations-common scenarios include user certificate upload portals, API authentication systems, or email encryption gateways. When the application calls phpseclib's ASN.1 decoding functions, the malicious OID triggers excessive memory or CPU consumption, causing the PHP process to hang or crash, resulting in denial of service for legitimate users. No public exploit identified at time of analysis, but the attack technique (ASN.1 amplification) is well-documented in cryptographic security research.