TI-2026-57943 Aliases CVE-2026-84308 GHSA-q97c-8qh3-fpc6

phpseclib — non-constant-time X25519 scalar multiplication permits full private-key recovery

MEDIUM 63CWE-208Published 2026-09-01 · Updated 2026-09-03

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: High
Impact type: Information disclosure
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-208.

Summary

phpseclib is a PHP secure communications library. Prior to 3.0.57 and 4.0.1, pure-PHP X25519 scalar multiplication in phpseclib/Math/PrimeField/Integer.php performs data-dependent conditional modular reductions in add() and subtract(). During the Montgomery ladder in phpseclib/Crypt/EC/BaseCurves/Montgomery.php, the reduction behavior of each step depends on the secret scalar prefix, creating per-step timing and libgmp call-count observations that can reveal a reused 251-bit clamped private scalar. The phpseclib/Crypt/EC/Formats/Keys/MontgomeryPrivate.php derivation path invokes the pure-PHP multiplication without a native-engine check, while phpseclib/Crypt/EC/Formats/Keys/PKCS8.php reaches it when ext-sodium is unavailable. Exploitation requires a reused or long-lived X25519 private key, knowledge of the corresponding public key, execution of the pure-PHP path, and a local observer capable of resolving individual ladder steps or libgmp entry-point calls. Ephemeral X25519 keys, including phpseclib's normal SSH exchange path, are not affected. Recovery of the scalar permanently compromises operations that reuse that key. This issue is fixed in versions 3.0.57 and 4.0.1.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00327 25th percentileScored 2026-11-07

Fix Fixed phpseclib (phpseclib): 3.0.57, 4.0.1phpseclib/phpseclib (Packagist): 3.0.57, 4.0.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
phpseclib	phpseclib	before 3.0.57; 4.0.0 to before 4.0.1	3.0.57, 4.0.1	Patch available	CNA
—	phpseclib/phpseclib (Packagist)	before 3.0.57	3.0.57	Patch available	GHSA-q97c-8qh3-fpc6
—	phpseclib/phpseclib (Packagist)	4.0.0 to before 4.0.1	4.0.1	Patch available	GHSA-q97c-8qh3-fpc6

phpseclib Vendorphpseclib Affected before 3.0.57; 4.0.0 to before 4.0.1 Fixed in 3.0.57, 4.0.1 Patch available CNA
phpseclib/phpseclib (Packagist) Vendor— Affected before 3.0.57 Fixed in 3.0.57 Patch available GHSA-q97c-8qh3-fpc6
phpseclib/phpseclib (Packagist) Vendor— Affected 4.0.0 to before 4.0.1 Fixed in 4.0.1 Patch available GHSA-q97c-8qh3-fpc6

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:phpseclib:phpseclib::::::::	—	—	phpseclib

cpe:2.3:a:phpseclib:phpseclib:*:*:*:*:*:*:*:* Versions — — ·phpseclib

Remediation

Fix · CNA phpseclib (phpseclib) Fixed in 3.0.57, 4.0.1
Fix · GHSA-q97c-8qh3-fpc6 phpseclib/phpseclib (Packagist) Fixed in 3.0.57 Advisory →
Fix · GHSA-q97c-8qh3-fpc6 phpseclib/phpseclib (Packagist) Fixed in 4.0.1 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-02 Threatist record created from CVE-2026-84308
2026-10-03 Alias added: GHSA-q97c-8qh3-fpc6

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-84308

Other 5

TI-2026-40135 Server-side request forgery in phpseclib CVSS 3.1MEDIUM 5.8
TI-2026-29008 phpseclib has a variable-time HMAC comparison in SSH2::get_binary_packet() using != instead of hash_equals() CVSS 3.1LOW 3.7
TI-2023-29213 In phpseclib before 1.0.22, 2.x before 2.0.46, and 3.x before 3.0.33, some characters in… CVSS 3.1HIGH 7.5
TI-2024-18192 An issue was discovered in phpseclib 1.x before 1.0.23, 2.x before 2.0.47, and 3.x before… CVSS 3.1HIGH 7.5
TI-2024-18191 An issue was discovered in phpseclib 1.x before 1.0.23, 2.x before 2.0.47, and 3.x before… CVSS 3.1HIGH 7.5
TI-2023-12272 Math/PrimeField.php in phpseclib 3.x before 3.0.19 has an infinite loop with composite primefields. CVSS 3.1HIGH 7.5

See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences