CVE-2026-40194
LOW
3,7
Source: [email protected]
Attack Vector: network
Attack Complexity: high
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: low
Integrity: none
Availability: none
Description
AI Translation Available
phpseclib is a PHP secure communications library. Prior to 3.0.51, 2.0.53, and 1.0.28, phpseclib\Net\SSH2::get_binary_packet() uses PHP's != operator to compare a received SSH packet HMAC against the locally computed HMAC. != on equal-length binary strings in PHP uses memcmp(), which short-circuits on the first differing byte. This is a real variable-time comparison (CWE-208), proven by scaling benchmarks. This vulnerability is fixed in 3.0.51, 2.0.53, and 1.0.28.
EPSS (Exploit Prediction Scoring System)
Trend Analysis
EPSS (Exploit Prediction Scoring System)
Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.
EPSS Score
0,0001
Percentile
0,0th
Updated
EPSS Score Trend (Last 6 Days)
208
Observable Timing Discrepancy
IncompleteCommon Consequences
Security Scopes Affected:
Confidentiality
Access Control
Potential Impacts:
Read Application Data
Bypass Protection Mechanism
Applicable Platforms
All platforms may be affected
https://github.com/phpseclib/phpseclib/security/advisories/GHSA-r854-jrxh-36qx
https://github.com/phpseclib/phpseclib/commit/ffe48b6b1b1af6963327f0a5330e3aa00…
https://github.com/phpseclib/phpseclib/releases/tag/1.0.28
https://github.com/phpseclib/phpseclib/releases/tag/2.0.53
https://github.com/phpseclib/phpseclib/releases/tag/3.0.51
https://github.com/phpseclib/phpseclib/security/advisories/GHSA-r854-jrxh-36qx