CVE-2026-40194: phpseclib has a variable-time HMAC comparison in SSH2::get_binary_packet() using != instead of hash_equals()

Severity: low (CVSS 3.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-04-10 · updated 2026-06-17
Weakness: CWE-208

Description

phpseclib is a PHP secure communications library. Starting in 0.1.1 and prior to 3.0.51, 2.0.53, and 1.0.28, phpseclib\Net\SSH2::get_binary_packet() uses PHP's != operator to compare a received SSH packet HMAC against the locally computed HMAC. != on equal-length binary strings in PHP uses memcmp(), which short-circuits on the first differing byte. This is a real variable-time comparison (CWE-208), proven by scaling benchmarks. This vulnerability is fixed in 3.0.51, 2.0.53, and 1.0.28.

Affected products

phpseclib: through 1.0.27; from 2.0.0 before 2.0.53; from 3.0.0 before 3.0.51 — fixed in 2.0.53, 3.0.51
Packagist Phpseclib/Phpseclib: from 0.1.1 before 1.0.28; from 2.0.0 before 2.0.53; from 3.0.0 before 3.0.51; 0.3.0, 0.3.1, 0.3.10, 0.3.5, 0.3.6, 0.3.7 (+125) — fixed in 1.0.28, 2.0.53, 3.0.51

How to fix

Upgrade to a fixed version: phpseclib 2.0.53, 3.0.51; Packagist Phpseclib/Phpseclib 1.0.28, 2.0.53, 3.0.51. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-40194 or the next vulnerability affects your stack