CVE-2026-84308: phpseclib X25519 non-constant-time scalar multiplication private key recovery

CVE-2026-84308 · Severity: medium · CVSS 6.3 · Published 2026-09-01

phpseclib is a cryptographic library for PHP that provides elliptic curve operations, including X25519 key exchange used in secure communications. The pure-PHP implementation of X25519 scalar multiplication performs variable-time field arithmetic operations whose cost depends on the secret key's values, allowing a local attacker with per-operation observability (via timing or CPU operation counting) to recover the complete private key from as few as 1–32 observations. This breaks the confidentiality of long-lived keys used in protocols like ECDH when certain PHP configurations lack hardware-accelerated sodium or OpenSSL support.

Technologies: phpseclib/phpseclib (Packagist), Phpseclib. Vendors: Packagist, Phpseclib.

Quick answers

Is CVE-2026-84308 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-84308 being exploited in the wild.
How severe is CVE-2026-84308?
Medium severity, with a CVSS score of 6.3, published 1 September 2026.
Which products and versions are affected?
phpseclib/phpseclib (Packagist) ECOSYSTEM:introduced=0,fixed=3.0.57; Phpseclib >=3.0.0,<3.0.57 ; >=4.0.0,<4.0.1.
Is there a fix for CVE-2026-84308?
Yes. phpseclib/phpseclib (Packagist): upgrade to 3.0.57 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-84308 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-84308?
Check whether you run phpseclib/phpseclib (Packagist) or Phpseclib at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • phpseclib/phpseclib (Packagist): upgrade to 3.0.57 or later
    composer require phpseclib/phpseclib:^3.0.57

Technical details

phpseclib's Montgomery-ladder X25519 implementation uses non-constant-time field arithmetic in `Math/PrimeField/Integer.php` (methods `add()` at line 189 and `subtract()` at line 207). Each operation performs a data-dependent conditional modular reduction that costs ~0.85–1.0 microseconds on the GMP engine, leaking the count of reductions per ladder step as timing differences (~32 µs per step) or as exactly-determined libgmp call counts (`__gmpz_add` and `__gmpz_sub` entry points). The reduction count per step is a function of the secret scalar's binary prefix, not just the current bit. A beam-search decoder replaying both branches from candidate ladder states can recover the full 251-bit clamped scalar from as few as 1 libgmp call-count observation (20/20 keys) or 32 timing measurements (18–20/20 keys). Exploitation requires: (1) a reused X25519 private key (ephemeral keys are safe), (2) knowledge of the victim's public key to validate decoder output, (3) the pure-PHP path executing (occurs when both ext-sodium and ext-openssl are unavailable or disabled), and (4) per-ladder-step observability via local co-residency (Flush+Reload or libgmp call counting). Patches 3.0.57 and 4.0.1 implement constant-time field arithmetic and gate the vulnerable `MontgomeryPrivate.php:66` path.

Affected products

  • phpseclib phpseclib >=3.0.0,<3.0.57 ; >=4.0.0,<4.0.1

Identifiers

  • CVE-2026-84308
  • GHSA-q97c-8qh3-fpc6

Timeline

  • 2026-08-26: disclosed: Vulnerability disclosed via GitHub Advisory Database
  • 2026-08-26: patched: phpseclib 3.0.57 and 4.0.1 released with fixes
  • 2026-09-08: advisory: Published GHSA-q97c-8qh3-fpc6

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.