Vulnerability-Lookup

ubuntu-cve-2026-84308

Vulnerability from osv_ubuntu

Published

2026-09-02 00:00

Modified

2026-09-03 13:25

Summary

Details

(phpseclib is a PHP secure communications library. Prior to 3.0.57 and ...)

Severity

6.3 (Medium)


                    
                      CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2026-84308	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-84308	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libapache2-mod-php5",
            "binary_version": "5.5.9+dfsg-1ubuntu4.29+esm16"
          },
          {
            "binary_name": "libapache2-mod-php5filter",
            "binary_version": "5.5.9+dfsg-1ubuntu4.29+esm16"
          },
          {
            "binary_name": "libphp5-embed",
            "binary_version": "5.5.9+dfsg-1ubuntu4.29+esm16"
          },
          {
            "binary_name": "php-pear",
            "binary_version": "5.5.9+dfsg-1ubuntu4.29+esm16"
          },
          {
            "binary_name": "php5",
            "binary_version": "5.5.9+dfsg-1ubuntu4.29+esm16"
          },
          {
            "binary_name": "php5-cgi",
            "binary_version": "5.5.9+dfsg-1ubuntu4.29+esm16"
          },
          {
            "binary_name": "php5-cli",
            "binary_version": "5.5.9+dfsg-1ubuntu4.29+esm16"
          },
          {
            "binary_name": "php5-common",
            "binary_version": "5.5.9+dfsg-1ubuntu4.29+esm16"
          },
          {
            "binary_name": "php5-curl",
            "binary_version": "5.5.9+dfsg-1ubuntu4.29+esm16"
          },
          {
            "binary_name": "php5-enchant",
            "binary_version": "5.5.9+dfsg-1ubuntu4.29+esm16"
          },
          {
            "binary_name": "php5-fpm",
            "binary_version": "5.5.9+dfsg-1ubuntu4.29+esm16"
          },
          {
            "binary_name": "php5-gd",
            "binary_version": "5.5.9+dfsg-1ubuntu4.29+esm16"
          },
          {
            "binary_name": "php5-gmp",
            "binary_version": "5.5.9+dfsg-1ubuntu4.29+esm16"
          },
          {
            "binary_name": "php5-intl",
            "binary_version": "5.5.9+dfsg-1ubuntu4.29+esm16"
          },
          {
            "binary_name": "php5-ldap",
            "binary_version": "5.5.9+dfsg-1ubuntu4.29+esm16"
          },
          {
            "binary_name": "php5-mysql",
            "binary_version": "5.5.9+dfsg-1ubuntu4.29+esm16"
          },
          {
            "binary_name": "php5-mysqlnd",
            "binary_version": "5.5.9+dfsg-1ubuntu4.29+esm16"
          },
          {
            "binary_name": "php5-odbc",
            "binary_version": "5.5.9+dfsg-1ubuntu4.29+esm16"
          },
          {
            "binary_name": "php5-pgsql",
            "binary_version": "5.5.9+dfsg-1ubuntu4.29+esm16"
          },
          {
            "binary_name": "php5-pspell",
            "binary_version": "5.5.9+dfsg-1ubuntu4.29+esm16"
          },
          {
            "binary_name": "php5-readline",
            "binary_version": "5.5.9+dfsg-1ubuntu4.29+esm16"
          },
          {
            "binary_name": "php5-recode",
            "binary_version": "5.5.9+dfsg-1ubuntu4.29+esm16"
          },
          {
            "binary_name": "php5-snmp",
            "binary_version": "5.5.9+dfsg-1ubuntu4.29+esm16"
          },
          {
            "binary_name": "php5-sqlite",
            "binary_version": "5.5.9+dfsg-1ubuntu4.29+esm16"
          },
          {
            "binary_name": "php5-sybase",
            "binary_version": "5.5.9+dfsg-1ubuntu4.29+esm16"
          },
          {
            "binary_name": "php5-tidy",
            "binary_version": "5.5.9+dfsg-1ubuntu4.29+esm16"
          },
          {
            "binary_name": "php5-xmlrpc",
            "binary_version": "5.5.9+dfsg-1ubuntu4.29+esm16"
          },
          {
            "binary_name": "php5-xsl",
            "binary_version": "5.5.9+dfsg-1ubuntu4.29+esm16"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:14.04:LTS",
        "name": "php5",
        "purl": "pkg:deb/ubuntu/php5@5.5.9+dfsg-1ubuntu4.29+esm16?arch=source\u0026distro=esm-infra-legacy/trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "5.5.3+dfsg-1ubuntu2",
        "5.5.3+dfsg-1ubuntu3",
        "5.5.6+dfsg-1ubuntu1",
        "5.5.6+dfsg-1ubuntu2",
        "5.5.8+dfsg-2ubuntu1",
        "5.5.9+dfsg-1ubuntu1",
        "5.5.9+dfsg-1ubuntu2",
        "5.5.9+dfsg-1ubuntu3",
        "5.5.9+dfsg-1ubuntu4",
        "5.5.9+dfsg-1ubuntu4.1",
        "5.5.9+dfsg-1ubuntu4.2",
        "5.5.9+dfsg-1ubuntu4.3",
        "5.5.9+dfsg-1ubuntu4.4",
        "5.5.9+dfsg-1ubuntu4.5",
        "5.5.9+dfsg-1ubuntu4.6",
        "5.5.9+dfsg-1ubuntu4.7",
        "5.5.9+dfsg-1ubuntu4.9",
        "5.5.9+dfsg-1ubuntu4.11",
        "5.5.9+dfsg-1ubuntu4.12",
        "5.5.9+dfsg-1ubuntu4.13",
        "5.5.9+dfsg-1ubuntu4.14",
        "5.5.9+dfsg-1ubuntu4.16",
        "5.5.9+dfsg-1ubuntu4.17",
        "5.5.9+dfsg-1ubuntu4.19",
        "5.5.9+dfsg-1ubuntu4.20",
        "5.5.9+dfsg-1ubuntu4.21",
        "5.5.9+dfsg-1ubuntu4.22",
        "5.5.9+dfsg-1ubuntu4.23",
        "5.5.9+dfsg-1ubuntu4.24",
        "5.5.9+dfsg-1ubuntu4.25",
        "5.5.9+dfsg-1ubuntu4.26",
        "5.5.9+dfsg-1ubuntu4.27",
        "5.5.9+dfsg-1ubuntu4.29",
        "5.5.9+dfsg-1ubuntu4.29+esm1",
        "5.5.9+dfsg-1ubuntu4.29+esm2",
        "5.5.9+dfsg-1ubuntu4.29+esm3",
        "5.5.9+dfsg-1ubuntu4.29+esm4",
        "5.5.9+dfsg-1ubuntu4.29+esm5",
        "5.5.9+dfsg-1ubuntu4.29+esm6",
        "5.5.9+dfsg-1ubuntu4.29+esm8",
        "5.5.9+dfsg-1ubuntu4.29+esm10",
        "5.5.9+dfsg-1ubuntu4.29+esm11",
        "5.5.9+dfsg-1ubuntu4.29+esm12",
        "5.5.9+dfsg-1ubuntu4.29+esm13",
        "5.5.9+dfsg-1ubuntu4.29+esm14",
        "5.5.9+dfsg-1ubuntu4.29+esm15",
        "5.5.9+dfsg-1ubuntu4.29+esm16"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "php-seclib",
            "binary_version": "1.0.1-3ubuntu0.1+esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:16.04:LTS",
        "name": "phpseclib",
        "purl": "pkg:deb/ubuntu/phpseclib@1.0.1-3ubuntu0.1+esm1?arch=source\u0026distro=esm-apps/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.3.10-3",
        "1.0.0-2",
        "1.0.0-3",
        "1.0.1-1",
        "1.0.1-3",
        "1.0.1-3ubuntu0.1",
        "1.0.1-3ubuntu0.1+esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libapache2-mod-php7.2",
            "binary_version": "7.2.24-0ubuntu0.18.04.17+esm12"
          },
          {
            "binary_name": "libphp7.2-embed",
            "binary_version": "7.2.24-0ubuntu0.18.04.17+esm12"
          },
          {
            "binary_name": "php7.2",
            "binary_version": "7.2.24-0ubuntu0.18.04.17+esm12"
          },
          {
            "binary_name": "php7.2-bcmath",
            "binary_version": "7.2.24-0ubuntu0.18.04.17+esm12"
          },
          {
            "binary_name": "php7.2-bz2",
            "binary_version": "7.2.24-0ubuntu0.18.04.17+esm12"
          },
          {
            "binary_name": "php7.2-cgi",
            "binary_version": "7.2.24-0ubuntu0.18.04.17+esm12"
          },
          {
            "binary_name": "php7.2-cli",
            "binary_version": "7.2.24-0ubuntu0.18.04.17+esm12"
          },
          {
            "binary_name": "php7.2-common",
            "binary_version": "7.2.24-0ubuntu0.18.04.17+esm12"
          },
          {
            "binary_name": "php7.2-curl",
            "binary_version": "7.2.24-0ubuntu0.18.04.17+esm12"
          },
          {
            "binary_name": "php7.2-dba",
            "binary_version": "7.2.24-0ubuntu0.18.04.17+esm12"
          },
          {
            "binary_name": "php7.2-enchant",
            "binary_version": "7.2.24-0ubuntu0.18.04.17+esm12"
          },
          {
            "binary_name": "php7.2-fpm",
            "binary_version": "7.2.24-0ubuntu0.18.04.17+esm12"
          },
          {
            "binary_name": "php7.2-gd",
            "binary_version": "7.2.24-0ubuntu0.18.04.17+esm12"
          },
          {
            "binary_name": "php7.2-gmp",
            "binary_version": "7.2.24-0ubuntu0.18.04.17+esm12"
          },
          {
            "binary_name": "php7.2-imap",
            "binary_version": "7.2.24-0ubuntu0.18.04.17+esm12"
          },
          {
            "binary_name": "php7.2-interbase",
            "binary_version": "7.2.24-0ubuntu0.18.04.17+esm12"
          },
          {
            "binary_name": "php7.2-intl",
            "binary_version": "7.2.24-0ubuntu0.18.04.17+esm12"
          },
          {
            "binary_name": "php7.2-json",
            "binary_version": "7.2.24-0ubuntu0.18.04.17+esm12"
          },
          {
            "binary_name": "php7.2-ldap",
            "binary_version": "7.2.24-0ubuntu0.18.04.17+esm12"
          },
          {
            "binary_name": "php7.2-mbstring",
            "binary_version": "7.2.24-0ubuntu0.18.04.17+esm12"
          },
          {
            "binary_name": "php7.2-mysql",
            "binary_version": "7.2.24-0ubuntu0.18.04.17+esm12"
          },
          {
            "binary_name": "php7.2-odbc",
            "binary_version": "7.2.24-0ubuntu0.18.04.17+esm12"
          },
          {
            "binary_name": "php7.2-opcache",
            "binary_version": "7.2.24-0ubuntu0.18.04.17+esm12"
          },
          {
            "binary_name": "php7.2-pgsql",
            "binary_version": "7.2.24-0ubuntu0.18.04.17+esm12"
          },
          {
            "binary_name": "php7.2-phpdbg",
            "binary_version": "7.2.24-0ubuntu0.18.04.17+esm12"
          },
          {
            "binary_name": "php7.2-pspell",
            "binary_version": "7.2.24-0ubuntu0.18.04.17+esm12"
          },
          {
            "binary_name": "php7.2-readline",
            "binary_version": "7.2.24-0ubuntu0.18.04.17+esm12"
          },
          {
            "binary_name": "php7.2-recode",
            "binary_version": "7.2.24-0ubuntu0.18.04.17+esm12"
          },
          {
            "binary_name": "php7.2-snmp",
            "binary_version": "7.2.24-0ubuntu0.18.04.17+esm12"
          },
          {
            "binary_name": "php7.2-soap",
            "binary_version": "7.2.24-0ubuntu0.18.04.17+esm12"
          },
          {
            "binary_name": "php7.2-sqlite3",
            "binary_version": "7.2.24-0ubuntu0.18.04.17+esm12"
          },
          {
            "binary_name": "php7.2-sybase",
            "binary_version": "7.2.24-0ubuntu0.18.04.17+esm12"
          },
          {
            "binary_name": "php7.2-tidy",
            "binary_version": "7.2.24-0ubuntu0.18.04.17+esm12"
          },
          {
            "binary_name": "php7.2-xml",
            "binary_version": "7.2.24-0ubuntu0.18.04.17+esm12"
          },
          {
            "binary_name": "php7.2-xmlrpc",
            "binary_version": "7.2.24-0ubuntu0.18.04.17+esm12"
          },
          {
            "binary_name": "php7.2-xsl",
            "binary_version": "7.2.24-0ubuntu0.18.04.17+esm12"
          },
          {
            "binary_name": "php7.2-zip",
            "binary_version": "7.2.24-0ubuntu0.18.04.17+esm12"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:18.04:LTS",
        "name": "php7.2",
        "purl": "pkg:deb/ubuntu/php7.2@7.2.24-0ubuntu0.18.04.17+esm12?arch=source\u0026distro=esm-infra/bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "7.2.1-1ubuntu2",
        "7.2.2-1ubuntu1",
        "7.2.2-1ubuntu2",
        "7.2.3-1ubuntu1",
        "7.2.5-0ubuntu0.18.04.1",
        "7.2.7-0ubuntu0.18.04.1",
        "7.2.7-0ubuntu0.18.04.2",
        "7.2.10-0ubuntu0.18.04.1",
        "7.2.15-0ubuntu0.18.04.1",
        "7.2.15-0ubuntu0.18.04.2",
        "7.2.17-0ubuntu0.18.04.1",
        "7.2.19-0ubuntu0.18.04.1",
        "7.2.19-0ubuntu0.18.04.2",
        "7.2.24-0ubuntu0.18.04.1",
        "7.2.24-0ubuntu0.18.04.2",
        "7.2.24-0ubuntu0.18.04.3",
        "7.2.24-0ubuntu0.18.04.4",
        "7.2.24-0ubuntu0.18.04.6",
        "7.2.24-0ubuntu0.18.04.7",
        "7.2.24-0ubuntu0.18.04.8",
        "7.2.24-0ubuntu0.18.04.9",
        "7.2.24-0ubuntu0.18.04.10",
        "7.2.24-0ubuntu0.18.04.11",
        "7.2.24-0ubuntu0.18.04.12",
        "7.2.24-0ubuntu0.18.04.13",
        "7.2.24-0ubuntu0.18.04.15",
        "7.2.24-0ubuntu0.18.04.16",
        "7.2.24-0ubuntu0.18.04.17",
        "7.2.24-0ubuntu0.18.04.17+esm1",
        "7.2.24-0ubuntu0.18.04.17+esm2",
        "7.2.24-0ubuntu0.18.04.17+esm3",
        "7.2.24-0ubuntu0.18.04.17+esm4",
        "7.2.24-0ubuntu0.18.04.17+esm5",
        "7.2.24-0ubuntu0.18.04.17+esm6",
        "7.2.24-0ubuntu0.18.04.17+esm7",
        "7.2.24-0ubuntu0.18.04.17+esm8",
        "7.2.24-0ubuntu0.18.04.17+esm9",
        "7.2.24-0ubuntu0.18.04.17+esm10",
        "7.2.24-0ubuntu0.18.04.17+esm11",
        "7.2.24-0ubuntu0.18.04.17+esm12"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "php-seclib",
            "binary_version": "1.0.9-1ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:18.04:LTS",
        "name": "phpseclib",
        "purl": "pkg:deb/ubuntu/phpseclib@1.0.9-1ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.0.7-1",
        "1.0.8-1",
        "1.0.9-1",
        "1.0.9-1ubuntu0.1~esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libapache2-mod-php7.4",
            "binary_version": "7.4.3-4ubuntu2.29+esm3"
          },
          {
            "binary_name": "libphp7.4-embed",
            "binary_version": "7.4.3-4ubuntu2.29+esm3"
          },
          {
            "binary_name": "php7.4",
            "binary_version": "7.4.3-4ubuntu2.29+esm3"
          },
          {
            "binary_name": "php7.4-bcmath",
            "binary_version": "7.4.3-4ubuntu2.29+esm3"
          },
          {
            "binary_name": "php7.4-bz2",
            "binary_version": "7.4.3-4ubuntu2.29+esm3"
          },
          {
            "binary_name": "php7.4-cgi",
            "binary_version": "7.4.3-4ubuntu2.29+esm3"
          },
          {
            "binary_name": "php7.4-cli",
            "binary_version": "7.4.3-4ubuntu2.29+esm3"
          },
          {
            "binary_name": "php7.4-common",
            "binary_version": "7.4.3-4ubuntu2.29+esm3"
          },
          {
            "binary_name": "php7.4-curl",
            "binary_version": "7.4.3-4ubuntu2.29+esm3"
          },
          {
            "binary_name": "php7.4-dba",
            "binary_version": "7.4.3-4ubuntu2.29+esm3"
          },
          {
            "binary_name": "php7.4-enchant",
            "binary_version": "7.4.3-4ubuntu2.29+esm3"
          },
          {
            "binary_name": "php7.4-fpm",
            "binary_version": "7.4.3-4ubuntu2.29+esm3"
          },
          {
            "binary_name": "php7.4-gd",
            "binary_version": "7.4.3-4ubuntu2.29+esm3"
          },
          {
            "binary_name": "php7.4-gmp",
            "binary_version": "7.4.3-4ubuntu2.29+esm3"
          },
          {
            "binary_name": "php7.4-imap",
            "binary_version": "7.4.3-4ubuntu2.29+esm3"
          },
          {
            "binary_name": "php7.4-interbase",
            "binary_version": "7.4.3-4ubuntu2.29+esm3"
          },
          {
            "binary_name": "php7.4-intl",
            "binary_version": "7.4.3-4ubuntu2.29+esm3"
          },
          {
            "binary_name": "php7.4-json",
            "binary_version": "7.4.3-4ubuntu2.29+esm3"
          },
          {
            "binary_name": "php7.4-ldap",
            "binary_version": "7.4.3-4ubuntu2.29+esm3"
          },
          {
            "binary_name": "php7.4-mbstring",
            "binary_version": "7.4.3-4ubuntu2.29+esm3"
          },
          {
            "binary_name": "php7.4-mysql",
            "binary_version": "7.4.3-4ubuntu2.29+esm3"
          },
          {
            "binary_name": "php7.4-odbc",
            "binary_version": "7.4.3-4ubuntu2.29+esm3"
          },
          {
            "binary_name": "php7.4-opcache",
            "binary_version": "7.4.3-4ubuntu2.29+esm3"
          },
          {
            "binary_name": "php7.4-pgsql",
            "binary_version": "7.4.3-4ubuntu2.29+esm3"
          },
          {
            "binary_name": "php7.4-phpdbg",
            "binary_version": "7.4.3-4ubuntu2.29+esm3"
          },
          {
            "binary_name": "php7.4-pspell",
            "binary_version": "7.4.3-4ubuntu2.29+esm3"
          },
          {
            "binary_name": "php7.4-readline",
            "binary_version": "7.4.3-4ubuntu2.29+esm3"
          },
          {
            "binary_name": "php7.4-snmp",
            "binary_version": "7.4.3-4ubuntu2.29+esm3"
          },
          {
            "binary_name": "php7.4-soap",
            "binary_version": "7.4.3-4ubuntu2.29+esm3"
          },
          {
            "binary_name": "php7.4-sqlite3",
            "binary_version": "7.4.3-4ubuntu2.29+esm3"
          },
          {
            "binary_name": "php7.4-sybase",
            "binary_version": "7.4.3-4ubuntu2.29+esm3"
          },
          {
            "binary_name": "php7.4-tidy",
            "binary_version": "7.4.3-4ubuntu2.29+esm3"
          },
          {
            "binary_name": "php7.4-xml",
            "binary_version": "7.4.3-4ubuntu2.29+esm3"
          },
          {
            "binary_name": "php7.4-xmlrpc",
            "binary_version": "7.4.3-4ubuntu2.29+esm3"
          },
          {
            "binary_name": "php7.4-xsl",
            "binary_version": "7.4.3-4ubuntu2.29+esm3"
          },
          {
            "binary_name": "php7.4-zip",
            "binary_version": "7.4.3-4ubuntu2.29+esm3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:20.04:LTS",
        "name": "php7.4",
        "purl": "pkg:deb/ubuntu/php7.4@7.4.3-4ubuntu2.29+esm3?arch=source\u0026distro=esm-infra/focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "7.4.3-4build1",
        "7.4.3-4build2",
        "7.4.3-4ubuntu1",
        "7.4.3-4ubuntu1.1",
        "7.4.3-4ubuntu2.2",
        "7.4.3-4ubuntu2.4",
        "7.4.3-4ubuntu2.5",
        "7.4.3-4ubuntu2.6",
        "7.4.3-4ubuntu2.7",
        "7.4.3-4ubuntu2.8",
        "7.4.3-4ubuntu2.9",
        "7.4.3-4ubuntu2.10",
        "7.4.3-4ubuntu2.11",
        "7.4.3-4ubuntu2.12",
        "7.4.3-4ubuntu2.13",
        "7.4.3-4ubuntu2.15",
        "7.4.3-4ubuntu2.16",
        "7.4.3-4ubuntu2.17",
        "7.4.3-4ubuntu2.18",
        "7.4.3-4ubuntu2.19",
        "7.4.3-4ubuntu2.20",
        "7.4.3-4ubuntu2.22",
        "7.4.3-4ubuntu2.23",
        "7.4.3-4ubuntu2.24",
        "7.4.3-4ubuntu2.26",
        "7.4.3-4ubuntu2.28",
        "7.4.3-4ubuntu2.29",
        "7.4.3-4ubuntu2.29+esm1",
        "7.4.3-4ubuntu2.29+esm2",
        "7.4.3-4ubuntu2.29+esm3"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "php-seclib",
            "binary_version": "1.0.18-2ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:20.04:LTS",
        "name": "phpseclib",
        "purl": "pkg:deb/ubuntu/phpseclib@1.0.18-2ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.0.16-2",
        "1.0.18-2",
        "1.0.18-2ubuntu0.1~esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libapache2-mod-php7.4",
            "binary_version": "8.1.2-1ubuntu2.25"
          },
          {
            "binary_name": "libapache2-mod-php8.0",
            "binary_version": "8.1.2-1ubuntu2.25"
          },
          {
            "binary_name": "libapache2-mod-php8.1",
            "binary_version": "8.1.2-1ubuntu2.25"
          },
          {
            "binary_name": "libphp8.1-embed",
            "binary_version": "8.1.2-1ubuntu2.25"
          },
          {
            "binary_name": "php8.1",
            "binary_version": "8.1.2-1ubuntu2.25"
          },
          {
            "binary_name": "php8.1-bcmath",
            "binary_version": "8.1.2-1ubuntu2.25"
          },
          {
            "binary_name": "php8.1-bz2",
            "binary_version": "8.1.2-1ubuntu2.25"
          },
          {
            "binary_name": "php8.1-cgi",
            "binary_version": "8.1.2-1ubuntu2.25"
          },
          {
            "binary_name": "php8.1-cli",
            "binary_version": "8.1.2-1ubuntu2.25"
          },
          {
            "binary_name": "php8.1-common",
            "binary_version": "8.1.2-1ubuntu2.25"
          },
          {
            "binary_name": "php8.1-curl",
            "binary_version": "8.1.2-1ubuntu2.25"
          },
          {
            "binary_name": "php8.1-dba",
            "binary_version": "8.1.2-1ubuntu2.25"
          },
          {
            "binary_name": "php8.1-enchant",
            "binary_version": "8.1.2-1ubuntu2.25"
          },
          {
            "binary_name": "php8.1-fpm",
            "binary_version": "8.1.2-1ubuntu2.25"
          },
          {
            "binary_name": "php8.1-gd",
            "binary_version": "8.1.2-1ubuntu2.25"
          },
          {
            "binary_name": "php8.1-gmp",
            "binary_version": "8.1.2-1ubuntu2.25"
          },
          {
            "binary_name": "php8.1-imap",
            "binary_version": "8.1.2-1ubuntu2.25"
          },
          {
            "binary_name": "php8.1-interbase",
            "binary_version": "8.1.2-1ubuntu2.25"
          },
          {
            "binary_name": "php8.1-intl",
            "binary_version": "8.1.2-1ubuntu2.25"
          },
          {
            "binary_name": "php8.1-ldap",
            "binary_version": "8.1.2-1ubuntu2.25"
          },
          {
            "binary_name": "php8.1-mbstring",
            "binary_version": "8.1.2-1ubuntu2.25"
          },
          {
            "binary_name": "php8.1-mysql",
            "binary_version": "8.1.2-1ubuntu2.25"
          },
          {
            "binary_name": "php8.1-odbc",
            "binary_version": "8.1.2-1ubuntu2.25"
          },
          {
            "binary_name": "php8.1-opcache",
            "binary_version": "8.1.2-1ubuntu2.25"
          },
          {
            "binary_name": "php8.1-pgsql",
            "binary_version": "8.1.2-1ubuntu2.25"
          },
          {
            "binary_name": "php8.1-phpdbg",
            "binary_version": "8.1.2-1ubuntu2.25"
          },
          {
            "binary_name": "php8.1-pspell",
            "binary_version": "8.1.2-1ubuntu2.25"
          },
          {
            "binary_name": "php8.1-readline",
            "binary_version": "8.1.2-1ubuntu2.25"
          },
          {
            "binary_name": "php8.1-snmp",
            "binary_version": "8.1.2-1ubuntu2.25"
          },
          {
            "binary_name": "php8.1-soap",
            "binary_version": "8.1.2-1ubuntu2.25"
          },
          {
            "binary_name": "php8.1-sqlite3",
            "binary_version": "8.1.2-1ubuntu2.25"
          },
          {
            "binary_name": "php8.1-sybase",
            "binary_version": "8.1.2-1ubuntu2.25"
          },
          {
            "binary_name": "php8.1-tidy",
            "binary_version": "8.1.2-1ubuntu2.25"
          },
          {
            "binary_name": "php8.1-xml",
            "binary_version": "8.1.2-1ubuntu2.25"
          },
          {
            "binary_name": "php8.1-xsl",
            "binary_version": "8.1.2-1ubuntu2.25"
          },
          {
            "binary_name": "php8.1-zip",
            "binary_version": "8.1.2-1ubuntu2.25"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "php8.1",
        "purl": "pkg:deb/ubuntu/php8.1@8.1.2-1ubuntu2.25?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "8.1.0~rc4-1ubuntu2",
        "8.1.0-1",
        "8.1.2-1ubuntu1",
        "8.1.2-1ubuntu2",
        "8.1.2-1ubuntu2.1",
        "8.1.2-1ubuntu2.2",
        "8.1.2-1ubuntu2.3",
        "8.1.2-1ubuntu2.4",
        "8.1.2-1ubuntu2.5",
        "8.1.2-1ubuntu2.6",
        "8.1.2-1ubuntu2.8",
        "8.1.2-1ubuntu2.9",
        "8.1.2-1ubuntu2.10",
        "8.1.2-1ubuntu2.11",
        "8.1.2-1ubuntu2.13",
        "8.1.2-1ubuntu2.14",
        "8.1.2-1ubuntu2.15",
        "8.1.2-1ubuntu2.17",
        "8.1.2-1ubuntu2.18",
        "8.1.2-1ubuntu2.19",
        "8.1.2-1ubuntu2.20",
        "8.1.2-1ubuntu2.21",
        "8.1.2-1ubuntu2.22",
        "8.1.2-1ubuntu2.23",
        "8.1.2-1ubuntu2.24",
        "8.1.2-1ubuntu2.25"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "php-seclib",
            "binary_version": "1.0.20-1ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:22.04:LTS",
        "name": "phpseclib",
        "purl": "pkg:deb/ubuntu/phpseclib@1.0.20-1ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.0.19-3ubuntu2",
        "1.0.19-3ubuntu3",
        "1.0.20-1",
        "1.0.20-1ubuntu0.1~esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libapache2-mod-php8.3",
            "binary_version": "8.3.6-0ubuntu0.24.04.10"
          },
          {
            "binary_name": "libphp8.3-embed",
            "binary_version": "8.3.6-0ubuntu0.24.04.10"
          },
          {
            "binary_name": "php8.3",
            "binary_version": "8.3.6-0ubuntu0.24.04.10"
          },
          {
            "binary_name": "php8.3-bcmath",
            "binary_version": "8.3.6-0ubuntu0.24.04.10"
          },
          {
            "binary_name": "php8.3-bz2",
            "binary_version": "8.3.6-0ubuntu0.24.04.10"
          },
          {
            "binary_name": "php8.3-cgi",
            "binary_version": "8.3.6-0ubuntu0.24.04.10"
          },
          {
            "binary_name": "php8.3-cli",
            "binary_version": "8.3.6-0ubuntu0.24.04.10"
          },
          {
            "binary_name": "php8.3-common",
            "binary_version": "8.3.6-0ubuntu0.24.04.10"
          },
          {
            "binary_name": "php8.3-curl",
            "binary_version": "8.3.6-0ubuntu0.24.04.10"
          },
          {
            "binary_name": "php8.3-dba",
            "binary_version": "8.3.6-0ubuntu0.24.04.10"
          },
          {
            "binary_name": "php8.3-enchant",
            "binary_version": "8.3.6-0ubuntu0.24.04.10"
          },
          {
            "binary_name": "php8.3-fpm",
            "binary_version": "8.3.6-0ubuntu0.24.04.10"
          },
          {
            "binary_name": "php8.3-gd",
            "binary_version": "8.3.6-0ubuntu0.24.04.10"
          },
          {
            "binary_name": "php8.3-gmp",
            "binary_version": "8.3.6-0ubuntu0.24.04.10"
          },
          {
            "binary_name": "php8.3-imap",
            "binary_version": "8.3.6-0ubuntu0.24.04.10"
          },
          {
            "binary_name": "php8.3-interbase",
            "binary_version": "8.3.6-0ubuntu0.24.04.10"
          },
          {
            "binary_name": "php8.3-intl",
            "binary_version": "8.3.6-0ubuntu0.24.04.10"
          },
          {
            "binary_name": "php8.3-ldap",
            "binary_version": "8.3.6-0ubuntu0.24.04.10"
          },
          {
            "binary_name": "php8.3-mbstring",
            "binary_version": "8.3.6-0ubuntu0.24.04.10"
          },
          {
            "binary_name": "php8.3-mysql",
            "binary_version": "8.3.6-0ubuntu0.24.04.10"
          },
          {
            "binary_name": "php8.3-odbc",
            "binary_version": "8.3.6-0ubuntu0.24.04.10"
          },
          {
            "binary_name": "php8.3-opcache",
            "binary_version": "8.3.6-0ubuntu0.24.04.10"
          },
          {
            "binary_name": "php8.3-pgsql",
            "binary_version": "8.3.6-0ubuntu0.24.04.10"
          },
          {
            "binary_name": "php8.3-phpdbg",
            "binary_version": "8.3.6-0ubuntu0.24.04.10"
          },
          {
            "binary_name": "php8.3-pspell",
            "binary_version": "8.3.6-0ubuntu0.24.04.10"
          },
          {
            "binary_name": "php8.3-readline",
            "binary_version": "8.3.6-0ubuntu0.24.04.10"
          },
          {
            "binary_name": "php8.3-snmp",
            "binary_version": "8.3.6-0ubuntu0.24.04.10"
          },
          {
            "binary_name": "php8.3-soap",
            "binary_version": "8.3.6-0ubuntu0.24.04.10"
          },
          {
            "binary_name": "php8.3-sqlite3",
            "binary_version": "8.3.6-0ubuntu0.24.04.10"
          },
          {
            "binary_name": "php8.3-sybase",
            "binary_version": "8.3.6-0ubuntu0.24.04.10"
          },
          {
            "binary_name": "php8.3-tidy",
            "binary_version": "8.3.6-0ubuntu0.24.04.10"
          },
          {
            "binary_name": "php8.3-xml",
            "binary_version": "8.3.6-0ubuntu0.24.04.10"
          },
          {
            "binary_name": "php8.3-xsl",
            "binary_version": "8.3.6-0ubuntu0.24.04.10"
          },
          {
            "binary_name": "php8.3-zip",
            "binary_version": "8.3.6-0ubuntu0.24.04.10"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "php8.3",
        "purl": "pkg:deb/ubuntu/php8.3@8.3.6-0ubuntu0.24.04.10?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "8.3.0-1",
        "8.3.0-1ubuntu1",
        "8.3.4-1",
        "8.3.4-1build1",
        "8.3.6-0maysync1",
        "8.3.6-0ubuntu0.24.04.1",
        "8.3.6-0ubuntu0.24.04.2",
        "8.3.6-0ubuntu0.24.04.3",
        "8.3.6-0ubuntu0.24.04.4",
        "8.3.6-0ubuntu0.24.04.5",
        "8.3.6-0ubuntu0.24.04.6",
        "8.3.6-0ubuntu0.24.04.7",
        "8.3.6-0ubuntu0.24.04.8",
        "8.3.6-0ubuntu0.24.04.9",
        "8.3.6-0ubuntu0.24.04.10"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "php-seclib",
            "binary_version": "1.0.23-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "phpseclib",
        "purl": "pkg:deb/ubuntu/phpseclib@1.0.23-1?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.0.21-2",
        "1.0.22-1",
        "1.0.23-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libapache2-mod-php8.5",
            "binary_version": "8.5.4-0ubuntu1.2"
          },
          {
            "binary_name": "libphp8.5-embed",
            "binary_version": "8.5.4-0ubuntu1.2"
          },
          {
            "binary_name": "php8.5",
            "binary_version": "8.5.4-0ubuntu1.2"
          },
          {
            "binary_name": "php8.5-bcmath",
            "binary_version": "8.5.4-0ubuntu1.2"
          },
          {
            "binary_name": "php8.5-bz2",
            "binary_version": "8.5.4-0ubuntu1.2"
          },
          {
            "binary_name": "php8.5-cgi",
            "binary_version": "8.5.4-0ubuntu1.2"
          },
          {
            "binary_name": "php8.5-cli",
            "binary_version": "8.5.4-0ubuntu1.2"
          },
          {
            "binary_name": "php8.5-common",
            "binary_version": "8.5.4-0ubuntu1.2"
          },
          {
            "binary_name": "php8.5-curl",
            "binary_version": "8.5.4-0ubuntu1.2"
          },
          {
            "binary_name": "php8.5-dba",
            "binary_version": "8.5.4-0ubuntu1.2"
          },
          {
            "binary_name": "php8.5-enchant",
            "binary_version": "8.5.4-0ubuntu1.2"
          },
          {
            "binary_name": "php8.5-fpm",
            "binary_version": "8.5.4-0ubuntu1.2"
          },
          {
            "binary_name": "php8.5-gd",
            "binary_version": "8.5.4-0ubuntu1.2"
          },
          {
            "binary_name": "php8.5-gmp",
            "binary_version": "8.5.4-0ubuntu1.2"
          },
          {
            "binary_name": "php8.5-interbase",
            "binary_version": "8.5.4-0ubuntu1.2"
          },
          {
            "binary_name": "php8.5-intl",
            "binary_version": "8.5.4-0ubuntu1.2"
          },
          {
            "binary_name": "php8.5-ldap",
            "binary_version": "8.5.4-0ubuntu1.2"
          },
          {
            "binary_name": "php8.5-litespeed",
            "binary_version": "8.5.4-0ubuntu1.2"
          },
          {
            "binary_name": "php8.5-mbstring",
            "binary_version": "8.5.4-0ubuntu1.2"
          },
          {
            "binary_name": "php8.5-mysql",
            "binary_version": "8.5.4-0ubuntu1.2"
          },
          {
            "binary_name": "php8.5-odbc",
            "binary_version": "8.5.4-0ubuntu1.2"
          },
          {
            "binary_name": "php8.5-pgsql",
            "binary_version": "8.5.4-0ubuntu1.2"
          },
          {
            "binary_name": "php8.5-phpdbg",
            "binary_version": "8.5.4-0ubuntu1.2"
          },
          {
            "binary_name": "php8.5-readline",
            "binary_version": "8.5.4-0ubuntu1.2"
          },
          {
            "binary_name": "php8.5-snmp",
            "binary_version": "8.5.4-0ubuntu1.2"
          },
          {
            "binary_name": "php8.5-soap",
            "binary_version": "8.5.4-0ubuntu1.2"
          },
          {
            "binary_name": "php8.5-sqlite3",
            "binary_version": "8.5.4-0ubuntu1.2"
          },
          {
            "binary_name": "php8.5-sybase",
            "binary_version": "8.5.4-0ubuntu1.2"
          },
          {
            "binary_name": "php8.5-tidy",
            "binary_version": "8.5.4-0ubuntu1.2"
          },
          {
            "binary_name": "php8.5-xml",
            "binary_version": "8.5.4-0ubuntu1.2"
          },
          {
            "binary_name": "php8.5-xsl",
            "binary_version": "8.5.4-0ubuntu1.2"
          },
          {
            "binary_name": "php8.5-zip",
            "binary_version": "8.5.4-0ubuntu1.2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "php8.5",
        "purl": "pkg:deb/ubuntu/php8.5@8.5.4-0ubuntu1.2?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "8.5.2-0ubuntu1",
        "8.5.4-0ubuntu1",
        "8.5.4-0ubuntu1.1",
        "8.5.4-0ubuntu1.2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "php-seclib",
            "binary_version": "1.0.24-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "phpseclib",
        "purl": "pkg:deb/ubuntu/phpseclib@1.0.24-1?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.0.23-6",
        "1.0.24-1"
      ]
    }
  ],
  "aliases": [],
  "details": "(phpseclib is a PHP secure communications library. Prior to 3.0.57 and ...)",
  "id": "UBUNTU-CVE-2026-84308",
  "modified": "2026-09-03T13:25:53Z",
  "published": "2026-09-02T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-84308"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-84308"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-84308"
  ]
}

CVE-2026-84308 (GCVE-0-2026-84308)

Vulnerability from cvelistv5 – Published: 2026-09-01 19:28 – Updated: 2026-09-03 17:41

Title

phpseclib — non-constant-time X25519 scalar multiplication permits full private-key recovery

Summary

phpseclib is a PHP secure communications library. Prior to 3.0.57 and 4.0.1, pure-PHP X25519 scalar multiplication in phpseclib/Math/PrimeField/Integer.php performs data-dependent conditional modular reductions in add() and subtract(). During the Montgomery ladder in phpseclib/Crypt/EC/BaseCurves/Montgomery.php, the reduction behavior of each step depends on the secret scalar prefix, creating per-step timing and libgmp call-count observations that can reveal a reused 251-bit clamped private scalar. The phpseclib/Crypt/EC/Formats/Keys/MontgomeryPrivate.php derivation path invokes the pure-PHP multiplication without a native-engine check, while phpseclib/Crypt/EC/Formats/Keys/PKCS8.php reaches it when ext-sodium is unavailable. Exploitation requires a reused or long-lived X25519 private key, knowledge of the corresponding public key, execution of the pure-PHP path, and a local observer capable of resolving individual ladder steps or libgmp entry-point calls. Ephemeral X25519 keys, including phpseclib's normal SSH exchange path, are not affected. Recovery of the scalar permanently compromises operations that reuse that key. This issue is fixed in versions 3.0.57 and 4.0.1.

Severity

6.3 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-03 17:41 UTC

CWE

CWE-208 - Observable Timing Discrepancy
CWE-385 - Covert Timing Channel

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/phpseclib/phpseclib/security/a…	x_refsource_CONFIRM
https://github.com/phpseclib/phpseclib/commit/fb5…	x_refsource_MISC
https://github.com/phpseclib/phpseclib/releases/t…	x_refsource_MISC
https://github.com/phpseclib/phpseclib/releases/t…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
phpseclib	phpseclib	Affected: < 3.0.57 Affected: >= 4.0.0, < 4.0.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-84308",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-03T17:41:43.770409Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-03T17:41:50.214Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/phpseclib/phpseclib/security/advisories/GHSA-q97c-8qh3-fpc6"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "phpseclib",
          "vendor": "phpseclib",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.0.57"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.0.0, \u003c 4.0.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "phpseclib is a PHP secure communications library. Prior to 3.0.57 and 4.0.1, pure-PHP X25519 scalar multiplication in phpseclib/Math/PrimeField/Integer.php performs data-dependent conditional modular reductions in add() and subtract(). During the Montgomery ladder in phpseclib/Crypt/EC/BaseCurves/Montgomery.php, the reduction behavior of each step depends on the secret scalar prefix, creating per-step timing and libgmp call-count observations that can reveal a reused 251-bit clamped private scalar. The phpseclib/Crypt/EC/Formats/Keys/MontgomeryPrivate.php derivation path invokes the pure-PHP multiplication without a native-engine check, while phpseclib/Crypt/EC/Formats/Keys/PKCS8.php reaches it when ext-sodium is unavailable. Exploitation requires a reused or long-lived X25519 private key, knowledge of the corresponding public key, execution of the pure-PHP path, and a local observer capable of resolving individual ladder steps or libgmp entry-point calls. Ephemeral X25519 keys, including phpseclib\u0027s normal SSH exchange path, are not affected. Recovery of the scalar permanently compromises operations that reuse that key. This issue is fixed in versions 3.0.57 and 4.0.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-208",
              "description": "CWE-208: Observable Timing Discrepancy",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-385",
              "description": "CWE-385: Covert Timing Channel",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-01T19:28:09.378Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/phpseclib/phpseclib/security/advisories/GHSA-q97c-8qh3-fpc6",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/phpseclib/phpseclib/security/advisories/GHSA-q97c-8qh3-fpc6"
        },
        {
          "name": "https://github.com/phpseclib/phpseclib/commit/fb56bc5bb9009b54a6c26b31aeec8ed944f17373",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/phpseclib/phpseclib/commit/fb56bc5bb9009b54a6c26b31aeec8ed944f17373"
        },
        {
          "name": "https://github.com/phpseclib/phpseclib/releases/tag/3.0.57",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/phpseclib/phpseclib/releases/tag/3.0.57"
        },
        {
          "name": "https://github.com/phpseclib/phpseclib/releases/tag/4.0.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/phpseclib/phpseclib/releases/tag/4.0.1"
        }
      ],
      "source": {
        "advisory": "GHSA-q97c-8qh3-fpc6",
        "discovery": "UNKNOWN"
      },
      "title": "phpseclib \u2014 non-constant-time X25519 scalar multiplication permits full private-key recovery"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-84308",
    "datePublished": "2026-09-01T19:28:09.378Z",
    "dateReserved": "2026-09-01T16:17:43.078Z",
    "dateUpdated": "2026-09-03T17:41:50.214Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.