CVE-2026-40194

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-40194
phpseclib is a PHP secure communications library. Prior to 3.0.51, 2.0.53, and 1.0.28, phpseclib\Net\SSH2::get_binary_packet() uses PHP's != operator to compare a received SSH packet HMAC against the locally computed HMAC. != on equal-length binary strings in PHP uses memcmp(), which short-circuits on the first differing byte. This is a real variable-time comparison (CWE-208), proven by scaling benchmarks. This vulnerability is fixed in 3.0.51, 2.0.53, and 1.0.28.

3.7 /10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/phpseclib/phpseclib/commit/ffe48b6b1b1af6963327f0a5330e3aa004a194ac Patch
https://github.com/phpseclib/phpseclib/releases/tag/1.0.28 Release Notes
https://github.com/phpseclib/phpseclib/releases/tag/2.0.53 Release Notes
https://github.com/phpseclib/phpseclib/releases/tag/3.0.51 Release Notes
https://github.com/phpseclib/phpseclib/security/advisories/GHSA-r854-jrxh-36qx Vendor Advisory
https://github.com/phpseclib/phpseclib/security/advisories/GHSA-r854-jrxh-36qx Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:phpseclib:phpseclib:*:*:*:*:*:*:*:*
cpe:2.3:a:phpseclib:phpseclib:*:*:*:*:*:*:*:*
cpe:2.3:a:phpseclib:phpseclib:*:*:*:*:*:*:*:*
History

21 Apr 2026, 19:19

Type Values Removed Values Added
First Time Phpseclib
Phpseclib phpseclib
CPE cpe:2.3:a:phpseclib:phpseclib:*:*:*:*:*:*:*:*
References () https://github.com/phpseclib/phpseclib/commit/ffe48b6b1b1af6963327f0a5330e3aa004a194ac - () https://github.com/phpseclib/phpseclib/commit/ffe48b6b1b1af6963327f0a5330e3aa004a194ac - Patch
References () https://github.com/phpseclib/phpseclib/releases/tag/1.0.28 - () https://github.com/phpseclib/phpseclib/releases/tag/1.0.28 - Release Notes
References () https://github.com/phpseclib/phpseclib/releases/tag/2.0.53 - () https://github.com/phpseclib/phpseclib/releases/tag/2.0.53 - Release Notes
References () https://github.com/phpseclib/phpseclib/releases/tag/3.0.51 - () https://github.com/phpseclib/phpseclib/releases/tag/3.0.51 - Release Notes
References () https://github.com/phpseclib/phpseclib/security/advisories/GHSA-r854-jrxh-36qx - () https://github.com/phpseclib/phpseclib/security/advisories/GHSA-r854-jrxh-36qx - Vendor Advisory

13 Apr 2026, 16:16

Type Values Removed Values Added
References () https://github.com/phpseclib/phpseclib/security/advisories/GHSA-r854-jrxh-36qx - () https://github.com/phpseclib/phpseclib/security/advisories/GHSA-r854-jrxh-36qx -

10 Apr 2026, 21:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-04-10 21:16

Updated : 2026-04-21 19:19

NVD link : CVE-2026-40194

Mitre link : CVE-2026-40194

CVE.ORG link : CVE-2026-40194

JSON object : View

Products Affected

phpseclib

  • phpseclib
CWE
CWE-208

Observable Timing Discrepancy