CVE catalog

CVE-2026-55599

phpseclib is a PHP secure communications library. From 0.1.1 until 1.0.30, 2.0.55, and 3.0.54, when an application validates an untrusted X.509 certificate with phpseclib, X509::validateSignature() re

[CVE catalog]

Severity
Medium · CVSS 5.8
Published
Source
[NVD] · [CVE record]
EPSS
0.21% · Oct 22, 2026

phpseclib is a PHP secure communications library. From 0.1.1 until 1.0.30, 2.0.55, and 3.0.54, when an application validates an untrusted X.509 certificate with phpseclib, X509::validateSignature() reads a URL out of that certificate's Authority Information Access (AIA) extension and connects to it. Attacker who supplies certificate fully controls host, port, and path of that connection. URL fetching is enabled by default, and no destination is blocked. An unauthenticated attacker can therefore make a validating server open connections to internal hosts and ports it should never reach, for example loopback 127.0.0.1, cloud metadata address 169.254.169.254, and internal-only services. This is a server-side request forgery (SSRF) caused by an insecure default. This vulnerability is fixed in 1.0.30, 2.0.55, and 3.0.54.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianphpseclibsid1.0.30-1fixed
Debianphpseclibtrixie1.0.23-6+deb13u3vulnerable
Debianphpseclibtrixie-security1.0.23-6+deb13u1vulnerable
Debianphpseclibbookworm1.0.20-1+deb12u5vulnerable
Debianphpseclibbookworm-security1.0.20-1+deb12u3vulnerable
Debianphp-phpseclibsid2.0.55-1fixed
Debianphp-phpseclibforky2.0.55-1fixed
Debianphp-phpseclibtrixie2.0.48-3+deb13u3vulnerable
Debianphp-phpseclibtrixie-security2.0.48-3+deb13u1vulnerable
Debianphp-phpseclibbookworm2.0.42-1+deb12u5vulnerable
Debianphp-phpseclibbookworm-security2.0.42-1+deb12u3vulnerable
Debianphp-phpseclib3sid3.0.57-1fixed
Debianphp-phpseclib3forky3.0.57-1fixed
Debianphp-phpseclib3trixie3.0.43-2+deb13u3vulnerable
Debianphp-phpseclib3trixie-security3.0.43-2+deb13u1vulnerable
Debianphp-phpseclib3bookworm3.0.19-1+deb12u6vulnerable
Debianphp-phpseclib3bookworm-security3.0.19-1+deb12u4vulnerable
Cpephp-phpseclibNot reportedNot reportedvulnerable
Cpephp-phpseclib3Not reportedNot reportedvulnerable
CpephpseclibNot reportedNot reportedvulnerable
CpephpseclibNot reported1.0.30fixed
CpephpseclibNot reported2.0.55fixed
CpephpseclibNot reported3.0.54fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianphpseclibsourcesid1.0.30-1not yet assignedNot reportedNot reported
Debianphpseclibsourcetrixie(unfixed)not yet assignedNot reportedNot reported
Debianphpseclibsourcebookworm(unfixed)not yet assignedNot reportedNot reported
Debianphp-phpseclibsourcesid2.0.55-1not yet assignedNot reportedNot reported
Debianphp-phpseclibsourceforky2.0.55-1not yet assignedNot reportedNot reported
Debianphp-phpseclibsourcetrixie(unfixed)not yet assignedNot reportedNot reported
Debianphp-phpseclibsourcebookworm(unfixed)not yet assignedNot reportedNot reported
Debianphp-phpseclib3sourcesid3.0.55-1not yet assignedNot reportedNot reported
Debianphp-phpseclib3sourceforky3.0.55-1not yet assignedNot reportedNot reported
Debianphp-phpseclib3sourcetrixie(unfixed)not yet assignedNot reportedNot reported
Debianphp-phpseclib3sourcebookworm(unfixed)not yet assignedNot reportedNot reported
CpephpseclibcpeNot reported1.0.30Not reportedNot reportedNot reported
CpephpseclibcpeNot reported2.0.55Not reportedNot reportedNot reported
CpephpseclibcpeNot reported3.0.54Not reportedNot reportedNot reported

Notes

[trixie] phpseclib: Minor issue [bookworm] phpseclib: Minor issue, SSRF [trixie] php-phpseclib: Minor issue [bookworm] php-phpseclib: Minor issue, SSRF [trixie] php-phpseclib3: Minor issue [bookworm] php-phpseclib3: Minor issue, SSRF

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [php-phpseclib]Affected
    Details (4)

    • 2.0.42-1+deb12u5 · all · bookworm

      Affected

      nvd · php-phpseclib · debian · bookworm; nvd · php-phpseclib · debian · 12

    • 2.0.42-1+deb12u5 · all · bookworm

      Affected

      nvd · php-phpseclib · debian · bookworm; nvd · php-phpseclib · debian · 12

    • 2.0.42-1+deb12u3 · all · bookworm-security

      Affected

      nvd · php-phpseclib · debian · bookworm; nvd · php-phpseclib · debian · 12

    • 2.0.42-1+deb12u3 · all · bookworm-security

      Affected

      nvd · php-phpseclib · debian · bookworm; nvd · php-phpseclib · debian · 12

  • [php-phpseclib3]Affected
    Details (4)

    • 3.0.19-1+deb12u6 · all · bookworm

      Affected

      nvd · php-phpseclib3 · debian · bookworm; nvd · php-phpseclib3 · debian · 12

    • 3.0.19-1+deb12u6 · all · bookworm

      Affected

      nvd · php-phpseclib3 · debian · bookworm; nvd · php-phpseclib3 · debian · 12

    • 3.0.19-1+deb12u4 · all · bookworm-security

      Affected

      nvd · php-phpseclib3 · debian · bookworm; nvd · php-phpseclib3 · debian · 12

    • 3.0.19-1+deb12u4 · all · bookworm-security

      Affected

      nvd · php-phpseclib3 · debian · bookworm; nvd · php-phpseclib3 · debian · 12

  • [php-seclib]Affected

    Source package: [phpseclib]

    Details (4)

    • 1.0.20-1+deb12u5 · all · bookworm

      Affected

      nvd · phpseclib · debian · bookworm; nvd · phpseclib · debian · 12

    • 1.0.20-1+deb12u5 · all · bookworm

      Affected

      nvd · phpseclib · debian · bookworm; nvd · phpseclib · debian · 12

    • 1.0.20-1+deb12u3 · all · bookworm-security

      Affected

      nvd · phpseclib · debian · bookworm; nvd · phpseclib · debian · 12

    • 1.0.20-1+deb12u3 · all · bookworm-security

      Affected

      nvd · phpseclib · debian · bookworm; nvd · phpseclib · debian · 12

[Debian 13 (Trixie)]

  • [php-phpseclib]Affected
    Details (4)

    • 2.0.48-3+deb13u3 · all · trixie

      Affected

      nvd · php-phpseclib · debian · 13

    • 2.0.48-3+deb13u3 · all · trixie

      Affected

      nvd · php-phpseclib · debian · 13

    • 2.0.48-3+deb13u1 · all · trixie-security

      Affected

      nvd · php-phpseclib · debian · 13

    • 2.0.48-3+deb13u1 · all · trixie-security

      Affected

      nvd · php-phpseclib · debian · 13

  • [php-phpseclib3]Affected
    Details (4)

    • 3.0.43-2+deb13u3 · all · trixie

      Affected

      nvd · php-phpseclib3 · debian · 13

    • 3.0.43-2+deb13u3 · all · trixie

      Affected

      nvd · php-phpseclib3 · debian · 13

    • 3.0.43-2+deb13u1 · all · trixie-security

      Affected

      nvd · php-phpseclib3 · debian · 13

    • 3.0.43-2+deb13u1 · all · trixie-security

      Affected

      nvd · php-phpseclib3 · debian · 13

  • [php-seclib]Affected

    Source package: [phpseclib]

    Details (4)

    • 1.0.23-6+deb13u3 · all · trixie

      Affected

      nvd · phpseclib · debian · 13

    • 1.0.23-6+deb13u3 · all · trixie

      Affected

      nvd · phpseclib · debian · 13

    • 1.0.23-6+deb13u1 · all · trixie-security

      Affected

      nvd · phpseclib · debian · 13

    • 1.0.23-6+deb13u1 · all · trixie-security

      Affected

      nvd · phpseclib · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database]