CVE-2026-84308 phpseclib CVE debrief

Who should care

Developers and administrators using phpseclib for secure communications should be aware of this vulnerability and take action to update their installations. Particular attention should be paid to systems that reuse X25519 private keys or have long-lived keys, as these are more susceptible to exploitation.

Technical summary

The phpseclib library, prior to versions 3.0.57 and 4.0.1, contains a timing attack vulnerability in its pure-PHP X25519 scalar multiplication implementation. This vulnerability allows a local observer to potentially recover a reused 251-bit clamped private scalar, compromising operations that reuse that key. The vulnerability is due to data-dependent conditional modular reductions in the add() and subtract() functions, which create per-step timing and libgmp call-count observations. This issue is fixed in versions 3.0.57 and 4.0.1 of phpseclib.

Defensive priority

Medium-priority defensive actions recommended due to potential for local observers to resolve individual ladder steps or libgmp entry-point calls, allowing recovery of the scalar and permanent compromise of operations that reuse that key.

Recommended defensive actions

• Update phpseclib to version 3.0.57 or 4.0.1 to fix the vulnerability
• Use native-engine checks for pure-PHP multiplication
• Avoid reusing X25519 private keys
• Monitor for local observers capable of resolving individual ladder steps or libgmp entry-point calls
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

Evidence from official CVE Program record and NIST NVD detail page indicates a timing attack vulnerability in phpseclib's pure-PHP X25519 scalar multiplication. Local observers may resolve individual ladder steps or libgmp entry-point calls to reveal a reused 251-bit clamped private scalar. Ephemeral X25519 keys are not affected.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.