VYPR
Get started
← All advisories
Medium severity5.9NVD Advisory· Published Mar 20, 2026· Updated May 8, 2026

CVE-2026-32935

CVE-2026-32935

Description

phpseclib is a PHP secure communications library. Projects using versions 0.1.1 through 1.0.26, 2.0.0 through 2.0.51, and 3.0.0 through 3.0.49 are vulnerable to a to padding oracle timing attack when using AES in CBC mode. This issue has been fixed in versions 1.0.27, 2.0.52 and 3.0.50.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
phpseclib/phpseclibPackagist
>= 3.0.0, < 3.0.503.0.50
phpseclib/phpseclibPackagist
>= 2.0.0, < 2.0.522.0.52
phpseclib/phpseclibPackagist
>= 0.1.1, < 1.0.271.0.27

Affected products

2
  • Phpseclib/Phpseclib2 versions
    cpe:2.3:a:phpseclib:phpseclib:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:phpseclib:phpseclib:*:*:*:*:*:*:*:*range: <1.0.27
    • (no CPE)range: >= 3.0.0, < 3.0.50

Patches

1
ccc21aef71eb

make unpadding constant time

https://github.com/phpseclib/phpseclibterrafrostMar 13, 2026via ghsa
commit
1 file changed · +1 −1
  • phpseclib/Crypt/Base.php+1 −1 modified
    @@ -2003,7 +2003,7 @@ function _unpad($text)
 
         $length = ord($text[strlen($text) - 1]);
 
-        if (!$length || $length > $this->block_size) {
+        if (!$length | ($length > $this->block_size)) {
             return false;
         }

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

4

News mentions

0

No linked articles in our index yet.