CVE-2026-32935 Details
Description
phpseclib is a PHP secure communications library. Projects using versions 0.1.1 through 1.0.26, 2.0.0 through 2.0.51, and 3.0.0 through 3.0.49 are vulnerable to a to padding oracle timing attack when using AES in CBC mode. This issue has been fixed in versions 1.0.27, 2.0.52 and 3.0.50.
A timing attack vulnerability has been identified in phpseclib, a PHP secure communications library, when using AES in CBC mode. This vulnerability affects versions 1.0.26 and prior, 2.0.0 through 2.0.51, and 3.0.0 through 3.0.49. The issue arises from the unpadding process, which is susceptible to a padding oracle timing attack, allowing an attacker to potentially exploit the vulnerability by manipulating the timing of responses.
Users can upgrade to phpseclib versions 1.0.27, 2.0.52, or 3.0.50 to address this vulnerability. Alternatively, AES can be used in CTR, CFB, or OFB modes to avoid the timing attack.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-208 | Observable Timing Discrepancy | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| phpseclib phpseclib | < 1.0.27 >= 2.0.0, < 2.0.52 >= 3.0.0, < 3.0.50 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 8, 2026 | CVE Modified | [email protected] |
| Mar 23, 2026 | Initial Analysis | [email protected] |
| Mar 20, 2026 | New CVE Received | [email protected] |