CVE-2026-32935
Medium · 5.9CVSS
5.9
EPSS
0.4%
Published
Mar 20, 2026
CISA due date
—
The record
phpseclib is a PHP secure communications library. Projects using versions 0.1.1 through 1.0.26, 2.0.0 through 2.0.51, and 3.0.0 through 3.0.49 are vulnerable to a to padding oracle timing attack when using AES in CBC mode. This issue has been fixed in versions 1.0.27, 2.0.52 and 3.0.50.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-87946 Observable Timing Discrepancy vulnerability in Drupal SAML SSO - Service Provider allows… CWE-208
- CVE-2026-49265 OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. CWE-208
- CVE-2026-77696 Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret… CWE-208
- CVE-2026-54875 Issue summary: A non-constant-time optimized implementation of scalar point… CWE-208
- CVE-2026-54872 Issue summary: The generic elliptic-curve scalar multiplication used for ECDSA and SM2… CWE-208
- CVE-2026-87737 An issue was discovered in the mirage-crypto-ec package before 2.4.0 for OCaml. CWE-208
- CVE-2026-84308 phpseclib is a PHP secure communications library. CWE-208
- CVE-2026-82449 Cockpit CMS before 2.14.1 contains an account enumeration vulnerability in the auth check… CWE-208