CVE-2026-32935

phpseclib is a PHP secure communications library. Projects using versions 1.0.26 and below, 2.0.0 through 2.0.51, and 3.0.0 through 3.0.49 are vulnerable to a to padding oracle timing attack when using AES in CBC mode. This issue has been fixed in versions 1.0.27, 2.0.52 and 3.0.50.

Scoring

Severity

HIGH

CVSS base score

8.2

CVSS vector

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

EPSS probability

0.37%

CWE

CWE-208

Published

2026-03-20

Last modified

2026-05-08

Affected products

• phpseclib phpseclib
• phpseclib phpseclib
• phpseclib phpseclib
• phpseclib phpseclib

Weakness type

• CWE-208

Related vulnerabilities

• CVE-2026-87737 — An issue was discovered in the mirage-crypto-ec package before 2.4.0 for OCaml. There is a timing...
• CVE-2026-16037 — Callback Authentication Bypass via Timing Attack in PayTR's PayTR Virtual Pos iFrame API (v9x) WHMCS Module
• CVE-2026-81159 — Commerce CyberSource - Moderately critical - Insufficient input validation - SA-CONTRIB-2026-106
• CVE-2026-84308 — phpseclib — non-constant-time X25519 scalar multiplication permits full private-key recovery
• CVE-2026-82449 — Cockpit CMS before 2.14.1 Account Enumeration via Auth Timing
• CVE-2026-55785 — free5GC AUSF uses non-constant-time authentication comparisons and logs XRES* in 5G-AKA
• CVE-2026-78500 — Dimension Blind SSRF via Database Test Connection Feature
• CVE-2026-80199 — Kimai before 2.54.0 Username Enumeration via Timing Oracle

Markdown version · Browse all CVEs