phpseclib has a CVE-2024-27355 mitigation bypass — OID amplification DoS in ASN1::decodeOID()

HIGH 7.5CVE-2026-44167 · GHSA-3qpq-r242-jqj7 · Published 12/05/2026 · updated 17/06/2026

In short

CVE-2026-44167 is a HIGH (CVSS 7.5) vulnerability affecting phpseclib/phpseclib.
Chance of exploitation in the next 30 days (EPSS): 0.20%, higher than 10.0% of all vulnerabilities.
Fix: update to 1.0.29, 2.0.54, 3.0.52 or later.

Package	Affected versions	Patched versions
phpseclib/phpseclib Packagist	`≥ 0.1.1, < 1.0.29≥ 2.0.0, < 2.0.54≥ 3.0.0, < 3.0.52`	`1.0.292.0.543.0.52`

Description

Impact

Anyone loading untrusted ASN1 files (eg. X509 certificates, RSA PKCS8 private or public keys, etc)

Patches

https://github.com/phpseclib/phpseclib/commit/d53d2021bcb9f6a04d5d44ec99e6bbef219a71bc

Workarounds

No.

References

https://github.com/phpseclib/phpseclib/commit/d53d2021bcb9f6a04d5d44ec99e6bbef219a71bc

NVD description

phpseclib is a PHP secure communications library. Prior to 1.0.29, 2.0.54, and 3.0.52, anyone loading untrusted ASN1 files (eg. X509 certificates, RSA PKCS8 private or public keys, etc). This is a bypass of CVE-2024-27355. This vulnerability is fixed in 1.0.29, 2.0.54, and 3.0.52.

References

phpseclib/phpseclib security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2026-44167 · ADVISORY
phpseclib/phpseclib commit d53d202 · WEB
phpseclib/phpseclib · PACKAGE

More vulnerabilities in phpseclib/phpseclib

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

phpseclib/phpseclib

Packagist

≥ 0.1.1, < 1.0.29≥ 2.0.0, < 2.0.54≥ 3.0.0, < 3.0.52

1.0.292.0.543.0.52

Description

NVD description

More vulnerabilities in phpseclib/phpseclib

See all →