CVE-2026-55599 Details
Description
phpseclib is a PHP secure communications library. From 0.1.1 until 1.0.30, 2.0.55, and 3.0.54, when an application validates an untrusted X.509 certificate with phpseclib, X509::validateSignature() reads a URL out of that certificate's Authority Information Access (AIA) extension and connects to it. Attacker who supplies certificate fully controls host, port, and path of that connection. URL fetching is enabled by default, and no destination is blocked. An unauthenticated attacker can therefore make a validating server open connections to internal hosts and ports it should never reach, for example loopback 127.0.0.1, cloud metadata address 169.254.169.254, and internal-only services. This is a server-side request forgery (SSRF) caused by an insecure default. This vulnerability is fixed in 1.0.30, 2.0.55, and 3.0.54.
A server-side request forgery (SSRF) vulnerability has been identified in phpseclib, a PHP library for secure communications. This issue affects versions 0.1.1 prior to 1.0.30, 2.0.55, and 3.0.54. The vulnerability arises when the library validates untrusted X.509 certificates. The 'validateSignature()' method reads a URL from the certificate's Authority Information Access (AIA) extension and automatically connects to it. Since the URL fetching feature is enabled by default and lacks any destination restrictions, an unauthenticated attacker can exploit this to make the server open connections to internal hosts and ports that should normally be inaccessible. This includes loopback addresses, cloud metadata endpoints, and private services.
Users can update to phpseclib versions 1.0.30, 2.0.55, or 3.0.54, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/phpseclib/phpseclib/security/advisories/GHSA-m557-wrgg-6rp4 | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/phpseclib/phpseclib/security/advisories/GHSA-m557-wrgg-6rp4 | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| phpseclib phpseclib | >= 0.1.1, < 1.0.30 >= 2.0.0, < 2.0.55 >= 3.0.0, < 3.0.54 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 26, 2026 | Initial Analysis | [email protected] |
| Jun 23, 2026 | CVE Modified | CISA-ADP |
| Jun 22, 2026 | New CVE Received | [email protected] |