UnratedFix available
php-phpseclib vulnerabilities
It was discovered that phpseclib did not perform constant-time padding validation when using AES in CBC mode. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2026-32935) It was discovered that phpseclib did not use a constant-time comparison when validating SSH packet authentication codes. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2026-40194) It was discovered that phpseclib did not properly limit object identifier lengths when parsing ASN.1 data. An attacker could possibly use this issue to cause phpseclib to use excessive resources, leading to a denial of service. (CVE-2026-44167)
Announced Group revision 1
Original source ↗USN-8830-1
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:USN-8830-1
php-phpseclib
Source reference: /affected/0/package/name
- Affected versions
- 2.0.1-1
Source reference:
/affected/0/versions2.0.1-1build1Source reference:
/affected/0/versions - Fixed versions
- 2.0.1-1ubuntu0.1~esm1
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
php-phpseclib
Source reference: /affected/1/package/name
- Affected versions
- 2.0.6-1
Source reference:
/affected/1/versions2.0.7-1Source reference:
/affected/1/versions2.0.9-1Source reference:
/affected/1/versions2.0.9-1ubuntu0.1~esm2Source reference:
/affected/1/versions - Fixed versions
- 2.0.9-1ubuntu0.1~esm3
Source reference:
/affected/1/ranges - Prerequisites
- Not stated in this record
php-phpseclib
Source reference: /affected/2/package/name
- Affected versions
- 2.0.21-2
Source reference:
/affected/2/versions2.0.23-2Source reference:
/affected/2/versions2.0.23-2ubuntu0.1~esm2Source reference:
/affected/2/versions - Fixed versions
- 2.0.23-2ubuntu0.1~esm3
Source reference:
/affected/2/ranges - Prerequisites
- Not stated in this record
php-phpseclib
Source reference: /affected/3/package/name
- Affected versions
- 2.0.30-2ubuntu1
Source reference:
/affected/3/versions2.0.34-1Source reference:
/affected/3/versions2.0.35-1Source reference:
/affected/3/versions2.0.36-1Source reference:
/affected/3/versions2.0.36-1ubuntu0.1~esm2Source reference:
/affected/3/versions - Fixed versions
- 2.0.36-1ubuntu0.1~esm3
Source reference:
/affected/3/ranges - Prerequisites
- Not stated in this record
php-phpseclib
Source reference: /affected/4/package/name
- Affected versions
- 2.0.44-1
Source reference:
/affected/4/versions2.0.45-1Source reference:
/affected/4/versions2.0.46-1Source reference:
/affected/4/versions2.0.47-1Source reference:
/affected/4/versions - Fixed versions
- 2.0.47-1ubuntu0.1~esm1
Source reference:
/affected/4/ranges - Prerequisites
- Not stated in this record
php-phpseclib
Source reference: /affected/5/package/name
- Affected versions
- 2.0.48-3
Source reference:
/affected/5/versions2.0.49-1Source reference:
/affected/5/versions2.0.51-1Source reference:
/affected/5/versions - Fixed versions
- 2.0.51-1ubuntu0.1~esm1
Source reference:
/affected/5/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.1-1ubuntu0.1~esm1"
}
]
}
],
"package": {
"name": "php-phpseclib",
"purl": "pkg:deb/ubuntu/php-phpseclib?arch=source&distro=esm-apps-legacy%2Fxenial",
"ecosystem": "Ubuntu:Pro:16.04:LTS"
},
"versions": [
"2.0.1-1",
"2.0.1-1build1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8830-1.json",
"cves_map": {
"cves": [
{
"id": "CVE-2026-32935",
"severity": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
},
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-40194",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-44167",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
}
],
"ecosystem": "Ubuntu:Pro:16.04:LTS"
}
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "php-phpseclib",
"binary_version": "2.0.1-1ubuntu0.1~esm1"
}
],
"availability": "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.9-1ubuntu0.1~esm3"
}
]
}
],
"package": {
"name": "php-phpseclib",
"purl": "pkg:deb/ubuntu/php-phpseclib?arch=source&distro=esm-apps%2Fbionic",
"ecosystem": "Ubuntu:Pro:18.04:LTS"
},
"versions": [
"2.0.6-1",
"2.0.7-1",
"2.0.9-1",
"2.0.9-1ubuntu0.1~esm2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8830-1.json",
"cves_map": {
"cves": [
{
"id": "CVE-2026-32935",
"severity": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
},
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-40194",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-44167",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
}
],
"ecosystem": "Ubuntu:Pro:18.04:LTS"
}
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "php-phpseclib",
"binary_version": "2.0.9-1ubuntu0.1~esm3"
}
],
"availability": "Available with Ubuntu Pro: https://ubuntu.com/pro"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.23-2ubuntu0.1~esm3"
}
]
}
],
"package": {
"name": "php-phpseclib",
"purl": "pkg:deb/ubuntu/php-phpseclib?arch=source&distro=esm-apps%2Ffocal",
"ecosystem": "Ubuntu:Pro:20.04:LTS"
},
"versions": [
"2.0.21-2",
"2.0.23-2",
"2.0.23-2ubuntu0.1~esm2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8830-1.json",
"cves_map": {
"cves": [
{
"id": "CVE-2026-32935",
"severity": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
},
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-40194",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-44167",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
}
],
"ecosystem": "Ubuntu:Pro:20.04:LTS"
}
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "php-phpseclib",
"binary_version": "2.0.23-2ubuntu0.1~esm3"
}
],
"availability": "Available with Ubuntu Pro: https://ubuntu.com/pro"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.36-1ubuntu0.1~esm3"
}
]
}
],
"package": {
"name": "php-phpseclib",
"purl": "pkg:deb/ubuntu/php-phpseclib?arch=source&distro=esm-apps%2Fjammy",
"ecosystem": "Ubuntu:Pro:22.04:LTS"
},
"versions": [
"2.0.30-2ubuntu1",
"2.0.34-1",
"2.0.35-1",
"2.0.36-1",
"2.0.36-1ubuntu0.1~esm2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8830-1.json",
"cves_map": {
"cves": [
{
"id": "CVE-2026-32935",
"severity": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
},
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-40194",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-44167",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
}
],
"ecosystem": "Ubuntu:Pro:22.04:LTS"
}
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "php-phpseclib",
"binary_version": "2.0.36-1ubuntu0.1~esm3"
}
],
"availability": "Available with Ubuntu Pro: https://ubuntu.com/pro"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.47-1ubuntu0.1~esm1"
}
]
}
],
"package": {
"name": "php-phpseclib",
"purl": "pkg:deb/ubuntu/php-phpseclib?arch=source&distro=esm-apps%2Fnoble",
"ecosystem": "Ubuntu:Pro:24.04:LTS"
},
"versions": [
"2.0.44-1",
"2.0.45-1",
"2.0.46-1",
"2.0.47-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8830-1.json",
"cves_map": {
"cves": [
{
"id": "CVE-2026-32935",
"severity": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
},
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-40194",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-44167",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
}
],
"ecosystem": "Ubuntu:Pro:24.04:LTS"
}
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "php-phpseclib",
"binary_version": "2.0.47-1ubuntu0.1~esm1"
}
],
"availability": "Available with Ubuntu Pro: https://ubuntu.com/pro"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.51-1ubuntu0.1~esm1"
}
]
}
],
"package": {
"name": "php-phpseclib",
"purl": "pkg:deb/ubuntu/php-phpseclib?arch=source&distro=esm-apps%2Fresolute",
"ecosystem": "Ubuntu:Pro:26.04:LTS"
},
"versions": [
"2.0.48-3",
"2.0.49-1",
"2.0.51-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8830-1.json",
"cves_map": {
"cves": [
{
"id": "CVE-2026-32935",
"severity": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
},
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-40194",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-44167",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
}
],
"ecosystem": "Ubuntu:Pro:26.04:LTS"
}
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "php-phpseclib",
"binary_version": "2.0.51-1ubuntu0.1~esm1"
}
],
"availability": "Available with Ubuntu Pro: https://ubuntu.com/pro"
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #23741 · Revision 1
- Added to Heist Feed
- Publisher date