Executive brief
phpseclib is a widely used PHP library for secure communications, handling tasks like encrypted connections and digital certificate processing. A flaw in how the library processes certain security files (like X.509 certificates or RSA keys) allows an attacker to cause a denial-of-service condition. By providing a specially crafted file, an attacker can exhaust server resources, potentially crashing the application or making the service unavailable to legitimate users.
Technical details
A vulnerability in phpseclib's ASN.1 decoding logic allows for uncontrolled resource consumption (CWE-400) via OID amplification. The issue exists in the ASN1::decodeOID() function, where excessively long Object Identifiers (OIDs) in untrusted files—such as X.509 certificates or PKCS8 keys—can trigger a denial-of-service (DoS) condition. This vulnerability is a bypass of the previous mitigation for CVE-2024-27355. An unauthenticated remote attacker can exploit this by submitting a crafted ASN.1 file for processing. The fix reduces the maximum supported OID length from 4096 bytes to 128 bytes. Patches are available in versions 1.0.29, 2.0.54, and 3.0.52.
Affected products
- phpseclib phpseclib < 1.0.29, < 2.0.54, < 3.0.52
Timeline
- 2026-04-27: advisory: GitHub Security Advisory published
- 2026-05-12: disclosed: CVE published to NVD