CVE-2026-40194

Katalog CVE

CVSS 3.7 · Low EPSS 0,37%

Kerentanan Observable Timing Discrepancy pada phpseclib. Skor CVSS 3.1 3.7 (Low) menurut github.com.

Deskripsi (NVD)

phpseclib is a PHP secure communications library. Starting in 0.1.1 and prior to 3.0.51, 2.0.53, and 1.0.28, phpseclib\Net\SSH2::get_binary_packet() uses PHP's != operator to compare a received SSH packet HMAC against the locally computed HMAC. != on equal-length binary strings in PHP uses memcmp(), which short-circuits on the first differing byte. This is a real variable-time comparison (CWE-208), proven by scaling benchmarks. This vulnerability is fixed in 3.0.51, 2.0.53, and 1.0.28.

Rincian

Terbit di NVD

10 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

3.7 (Low), sumber github.com
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-208: Observable Timing Discrepancy

EPSS (30 hari)

0,37% peluang dieksploitasi; lebih tinggi dari 28,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/phpseclib/phpseclib/security/advisories/GHSA-r854-jrxh-36qx advisory vendor
• https://github.com/phpseclib/phpseclib/commit/ffe48b6b1b1af6963327f0a5330e3aa004a194ac patch
• https://github.com/phpseclib/phpseclib/releases/tag/1.0.28 release notes
• https://github.com/phpseclib/phpseclib/releases/tag/2.0.53 release notes
• https://github.com/phpseclib/phpseclib/releases/tag/3.0.51 release notes