GHSA-f2qx-66wf-wvvx

Source

https://github.com/advisories/GHSA-f2qx-66wf-wvvx

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-f2qx-66wf-wvvx/GHSA-f2qx-66wf-wvvx.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-f2qx-66wf-wvvx

Aliases

CVE-2024-27355

Published

2026-05-08T18:24:30Z

Modified

2026-05-08T18:41:22Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

phpseclib guardrails needed on OID length

Details

Impact

Any application using that loads untrusted ASN1 files (eg. X509 certificates, RSA PKCS8 private or public keys, etc).

Patches

https://github.com/phpseclib/phpseclib/commit/e32531001b4d62c66c3d824ccef54ffad835eb59

Workarounds

No.

Resources

https://github.com/phpseclib/phpseclib/commit/e32531001b4d62c66c3d824ccef54ffad835eb59 https://www.usenix.org/system/files/conference/usenixsecurity25/sec25cycle1-prepub-599-shi-bing.pdf

Database specific

{
    "cwe_ids": [
        "CWE-400"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-08T18:24:30Z",
    "nvd_published_at": null,
    "severity": "HIGH"
}

References

Affected packages

Packagist / phpseclib/phpseclib

Package

Name: phpseclib/phpseclib
Purl: pkg:composer/phpseclib/phpseclib

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.0.0

Fixed

2.0.47

Affected versions

2.*

2.0.0

2.0.1

2.0.2

2.0.3

2.0.4

2.0.5

2.0.6

2.0.7

2.0.8

2.0.9

2.0.10

2.0.11

2.0.12

2.0.13

2.0.14

2.0.15

2.0.16

2.0.17

2.0.18

2.0.19

2.0.20

2.0.21

2.0.22

2.0.23

2.0.24

2.0.25

2.0.26

2.0.27

2.0.28

2.0.29

2.0.30

2.0.31

2.0.32

2.0.33

2.0.34

2.0.35

2.0.36

2.0.37

2.0.38

2.0.39

2.0.40

2.0.41

2.0.42

2.0.43

2.0.44

2.0.45

2.0.46

Database specific

last_known_affected_version_range

"<= 2.0.46"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-f2qx-66wf-wvvx/GHSA-f2qx-66wf-wvvx.json"

Packagist / phpseclib/phpseclib

Package

Name: phpseclib/phpseclib
Purl: pkg:composer/phpseclib/phpseclib

Affected ranges

Type: ECOSYSTEM
Events: Introduced

3.0.0

Fixed

3.0.36

Affected versions

3.*

3.0.0

3.0.1

3.0.2

3.0.3

3.0.4

3.0.5

3.0.6

3.0.7

3.0.8

3.0.9

3.0.10

3.0.11

3.0.12

3.0.13

3.0.14

3.0.15

3.0.16

3.0.17

3.0.18

3.0.19

3.0.20

3.0.21

3.0.22

3.0.23

3.0.33

3.0.34

3.0.35

Database specific

last_known_affected_version_range

"<= 3.0.35"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-f2qx-66wf-wvvx/GHSA-f2qx-66wf-wvvx.json"

Packagist / phpseclib/phpseclib

Package

Name: phpseclib/phpseclib
Purl: pkg:composer/phpseclib/phpseclib

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0.1.1

Fixed

1.0.23

Affected versions

0.*

0.3.0

0.3.1

0.3.5

0.3.6

0.3.7

0.3.8

0.3.9

0.3.10

1.*

1.0.0

1.0.1

1.0.2

1.0.3

1.0.4

1.0.5

1.0.6

1.0.7

1.0.8

1.0.9

1.0.10

1.0.11

1.0.12

1.0.13

1.0.14

1.0.15

1.0.16

1.0.17

1.0.18

1.0.19

1.0.20

1.0.21

1.0.22

Database specific

last_known_affected_version_range

"<= 1.0.22"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-f2qx-66wf-wvvx/GHSA-f2qx-66wf-wvvx.json"