# CVE-2026-84308: phpseclib X25519 non-constant-time scalar multiplication private key recovery

Source: https://junglewise.ai/threats/cve-2026-84308-phpseclib-x25519-non-constant-time-scalar-multiplication-private  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-01. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-84308 · Severity: medium · CVSS 6.3 · Published 2026-09-01

phpseclib is a cryptographic library for PHP that provides elliptic curve operations, including X25519 key exchange used in secure communications. The pure-PHP implementation of X25519 scalar multiplication performs variable-time field arithmetic operations whose cost depends on the secret key's values, allowing a local attacker with per-operation observability (via timing or CPU operation counting) to recover the complete private key from as few as 1–32 observations. This breaks the confidentiality of long-lived keys used in protocols like ECDH when certain PHP configurations lack hardware-accelerated sodium or OpenSSL support.

Technologies: [phpseclib/phpseclib (Packagist)](https://junglewise.ai/threats/technologies/phpseclib-phpseclib), [Phpseclib](https://junglewise.ai/threats/technologies/phpseclib). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist), [Phpseclib](https://junglewise.ai/threats/vendors/phpseclib).

## Quick answers

**Is CVE-2026-84308 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-84308 being exploited in the wild.

**How severe is CVE-2026-84308?** Medium severity, with a CVSS score of 6.3, published 1 September 2026.

**Which products and versions are affected?** phpseclib/phpseclib (Packagist) ECOSYSTEM:introduced=0,fixed=3.0.57; Phpseclib >=3.0.0,<3.0.57 ; >=4.0.0,<4.0.1.

**Is there a fix for CVE-2026-84308?** Yes. phpseclib/phpseclib (Packagist): upgrade to 3.0.57 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-84308 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-84308?** Check whether you run phpseclib/phpseclib (Packagist) or Phpseclib at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- phpseclib/phpseclib (Packagist): upgrade to 3.0.57 or later

  ```sh
  composer require phpseclib/phpseclib:^3.0.57
  ```


## Technical details

phpseclib's Montgomery-ladder X25519 implementation uses non-constant-time field arithmetic in `Math/PrimeField/Integer.php` (methods `add()` at line 189 and `subtract()` at line 207). Each operation performs a data-dependent conditional modular reduction that costs ~0.85–1.0 microseconds on the GMP engine, leaking the count of reductions per ladder step as timing differences (~32 µs per step) or as exactly-determined libgmp call counts (`__gmpz_add` and `__gmpz_sub` entry points). The reduction count per step is a function of the secret scalar's binary prefix, not just the current bit. A beam-search decoder replaying both branches from candidate ladder states can recover the full 251-bit clamped scalar from as few as 1 libgmp call-count observation (20/20 keys) or 32 timing measurements (18–20/20 keys). Exploitation requires: (1) a reused X25519 private key (ephemeral keys are safe), (2) knowledge of the victim's public key to validate decoder output, (3) the pure-PHP path executing (occurs when both ext-sodium and ext-openssl are unavailable or disabled), and (4) per-ladder-step observability via local co-residency (Flush+Reload or libgmp call counting). Patches 3.0.57 and 4.0.1 implement constant-time field arithmetic and gate the vulnerable `MontgomeryPrivate.php:66` path.

## Affected products

- phpseclib phpseclib >=3.0.0,<3.0.57 ; >=4.0.0,<4.0.1

## Identifiers

- CVE-2026-84308
- GHSA-q97c-8qh3-fpc6

## Timeline

- 2026-08-26: disclosed: Vulnerability disclosed via GitHub Advisory Database
- 2026-08-26: patched: phpseclib 3.0.57 and 4.0.1 released with fixes
- 2026-09-08: advisory: Published GHSA-q97c-8qh3-fpc6

## References

- [https://api.github.com/users/geostergiop](https://api.github.com/users/geostergiop)
- [https://github.com/geostergiop](https://github.com/geostergiop)
- [https://api.github.com/users/geostergiop/gists%7B/gist_id%7D](https://api.github.com/users/geostergiop/gists%7B/gist_id%7D)
- [https://api.github.com/users/geostergiop/repos](https://api.github.com/users/geostergiop/repos)
- [https://avatars.githubusercontent.com/u/8626213?v=4](https://avatars.githubusercontent.com/u/8626213?v=4)
- [https://api.github.com/users/geostergiop/events%7B/privacy%7D](https://api.github.com/users/geostergiop/events%7B/privacy%7D)

## Related threats

- [phpseclib SSRF in X.509 certificate validation](https://junglewise.ai/threats/cve-2026-55599-phpseclib-ssrf-in-x-509-certificate-validation)
- [phpseclib denial of service via OID amplification in ASN1 decoding](https://junglewise.ai/threats/cve-2026-44167-phpseclib-oid-amplification-dos-in-asn1-decodeoid)
- [Phpseclib needs guardrails on large binaryfield integers](https://junglewise.ai/threats/cve-2023-49316-phpseclib-needs-guardrails-on-large-binaryfield-integers)
- [phpseclib guardrails needed on OID length](https://junglewise.ai/threats/cve-2024-27355-phpseclib-guardrails-needed-on-oid-length)
- [phpseclib: guardrails needed on isPrime and randomPrime](https://junglewise.ai/threats/cve-2024-27354-phpseclib-guardrails-needed-on-isprime-and-randomprime)