CVE-2026-44167: phpseclib denial of service via OID amplification in ASN1 decoding

CVE-2026-44167 · Severity: high · CVSS 7.5 · Published 2026-05-12

phpseclib is a widely used PHP library for secure communications, handling tasks like encrypted connections and digital certificate processing. A flaw in how the library processes certain security files (like X.509 certificates or RSA keys) allows an attacker to cause a denial-of-service condition. By providing a specially crafted file, an attacker can exhaust server resources, potentially crashing the application or making the service unavailable to legitimate users.

Technologies: phpseclib/phpseclib (Packagist), Phpseclib. Vendors: Packagist, Phpseclib.

Quick answers

Is CVE-2026-44167 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-44167 being exploited in the wild.
How severe is CVE-2026-44167?
High severity, with a CVSS score of 7.5, published 12 May 2026.
Which products and versions are affected?
phpseclib/phpseclib (Packagist) ECOSYSTEM:introduced=0.1.1,fixed=1.0.29; Phpseclib < 1.0.29, < 2.0.54, < 3.0.52, >= 0.1.1, <= 1.0.28; >= 2.0.0, <= 2.0.53; >= 3.0.0, <= 3.0.51.
Is there a fix for CVE-2026-44167?
Yes. phpseclib/phpseclib (Packagist): upgrade to 1.0.29 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44167 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-44167?
Check whether you run phpseclib/phpseclib (Packagist) or Phpseclib at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • phpseclib/phpseclib (Packagist): upgrade to 1.0.29 or later
    composer require phpseclib/phpseclib:^1.0.29

Technical details

A vulnerability in phpseclib's ASN.1 decoding logic allows for uncontrolled resource consumption (CWE-400) via OID amplification. The issue exists in the ASN1::decodeOID() function, where excessively long Object Identifiers (OIDs) in untrusted files—such as X.509 certificates or PKCS8 keys—can trigger a denial-of-service (DoS) condition. This vulnerability is a bypass of the previous mitigation for CVE-2024-27355. An unauthenticated remote attacker can exploit this by submitting a crafted ASN.1 file for processing. The fix reduces the maximum supported OID length from 4096 bytes to 128 bytes. Patches are available in versions 1.0.29, 2.0.54, and 3.0.52.

Affected products

  • phpseclib phpseclib < 1.0.29, < 2.0.54, < 3.0.52

Identifiers

  • CVE-2026-44167
  • GHSA-3qpq-r242-jqj7

Timeline

  • 2026-04-27: advisory: GitHub Security Advisory published
  • 2026-05-12: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.