CVE-2026-44167: phpseclib: CVE-2024-27355 mitigation bypass — OID amplification DoS in ASN1::decodeOID()

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-12 · updated 2026-06-17
Weakness: CWE-400

Description

phpseclib is a PHP secure communications library. Prior to 1.0.29, 2.0.54, and 3.0.52, anyone loading untrusted ASN1 files (eg. X509 certificates, RSA PKCS8 private or public keys, etc). This is a bypass of CVE-2024-27355. This vulnerability is fixed in 1.0.29, 2.0.54, and 3.0.52.

Affected products

Packagist Phpseclib/Phpseclib: from 0.1.1 before 1.0.29; from 2.0.0 before 2.0.54; from 3.0.0 before 3.0.52; 0.3.0, 0.3.1, 0.3.10, 0.3.5, 0.3.6, 0.3.7 (+128) — fixed in 1.0.29, 2.0.54, 3.0.52
phpseclib: from 3.0.0, < 3.0.52; from 2.0.0, < 2.0.54; from 0.1.1, < 1.0.29

How to fix

Upgrade to a fixed version: Packagist Phpseclib/Phpseclib 1.0.29, 2.0.54, 3.0.52. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-44167 or the next vulnerability affects your stack