# CVE-2026-44167: phpseclib denial of service via OID amplification in ASN1 decoding

Source: https://junglewise.ai/threats/cve-2026-44167-phpseclib-oid-amplification-dos-in-asn1-decodeoid  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-12. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2026-44167 · Severity: high · CVSS 7.5 · Published 2026-05-12

phpseclib is a widely used PHP library for secure communications, handling tasks like encrypted connections and digital certificate processing. A flaw in how the library processes certain security files (like X.509 certificates or RSA keys) allows an attacker to cause a denial-of-service condition. By providing a specially crafted file, an attacker can exhaust server resources, potentially crashing the application or making the service unavailable to legitimate users.

Technologies: [phpseclib/phpseclib (Packagist)](https://junglewise.ai/threats/technologies/phpseclib-phpseclib), [Phpseclib](https://junglewise.ai/threats/technologies/phpseclib). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist), [Phpseclib](https://junglewise.ai/threats/vendors/phpseclib).

## Quick answers

**Is CVE-2026-44167 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44167 being exploited in the wild.

**How severe is CVE-2026-44167?** High severity, with a CVSS score of 7.5, published 12 May 2026.

**Which products and versions are affected?** phpseclib/phpseclib (Packagist) ECOSYSTEM:introduced=0.1.1,fixed=1.0.29; Phpseclib < 1.0.29, < 2.0.54, < 3.0.52, >= 0.1.1, <= 1.0.28; >= 2.0.0, <= 2.0.53; >= 3.0.0, <= 3.0.51.

**Is there a fix for CVE-2026-44167?** Yes. phpseclib/phpseclib (Packagist): upgrade to 1.0.29 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44167 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-44167?** Check whether you run phpseclib/phpseclib (Packagist) or Phpseclib at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- phpseclib/phpseclib (Packagist): upgrade to 1.0.29 or later

  ```sh
  composer require phpseclib/phpseclib:^1.0.29
  ```


## Technical details

A vulnerability in phpseclib's ASN.1 decoding logic allows for uncontrolled resource consumption (CWE-400) via OID amplification. The issue exists in the ASN1::decodeOID() function, where excessively long Object Identifiers (OIDs) in untrusted files—such as X.509 certificates or PKCS8 keys—can trigger a denial-of-service (DoS) condition. This vulnerability is a bypass of the previous mitigation for CVE-2024-27355. An unauthenticated remote attacker can exploit this by submitting a crafted ASN.1 file for processing. The fix reduces the maximum supported OID length from 4096 bytes to 128 bytes. Patches are available in versions 1.0.29, 2.0.54, and 3.0.52.

## Affected products

- phpseclib phpseclib < 1.0.29, < 2.0.54, < 3.0.52

## Identifiers

- CVE-2026-44167
- GHSA-3qpq-r242-jqj7

## Timeline

- 2026-04-27: advisory: GitHub Security Advisory published
- 2026-05-12: disclosed: CVE published to NVD

## References

- [https://github.com/phpseclib/phpseclib/commit/d53d2021bcb9f6a04d5d44ec99e6bbef219a71bc](https://github.com/phpseclib/phpseclib/commit/d53d2021bcb9f6a04d5d44ec99e6bbef219a71bc)
- [https://github.com/phpseclib/phpseclib/security/advisories/GHSA-3qpq-r242-jqj7](https://github.com/phpseclib/phpseclib/security/advisories/GHSA-3qpq-r242-jqj7)

## Related threats

- [phpseclib X25519 non-constant-time scalar multiplication private key recovery](https://junglewise.ai/threats/cve-2026-84308-phpseclib-x25519-non-constant-time-scalar-multiplication-private)
- [phpseclib SSRF in X.509 certificate validation](https://junglewise.ai/threats/cve-2026-55599-phpseclib-ssrf-in-x-509-certificate-validation)
- [Phpseclib needs guardrails on large binaryfield integers](https://junglewise.ai/threats/cve-2023-49316-phpseclib-needs-guardrails-on-large-binaryfield-integers)
- [phpseclib guardrails needed on OID length](https://junglewise.ai/threats/cve-2024-27355-phpseclib-guardrails-needed-on-oid-length)
- [phpseclib: guardrails needed on isPrime and randomPrime](https://junglewise.ai/threats/cve-2024-27354-phpseclib-guardrails-needed-on-isprime-and-randomprime)