debian/php-phpseclib4 vulnerabilities

Latest debian/php-phpseclib4 CVEs

Newest publication first

1. CVE-2026-84308 phpseclib — non-constant-time X25519 scalar multiplication permits full private-key recovery

   Published 2026-09-01

   Medium·CVSS 6.3 EPSS 0.33%

   phpseclib is a PHP secure communications library. Prior to 3.0.57 and 4.0.1, pure-PHP X25519 scalar multiplication in phpseclib/Math/PrimeField/Integer.php performs data-dependent conditional modular reductions in add() and subtract(). During the Montgomery ladder in phpseclib/Cr...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.