Back Linuxsecurity

Ubuntu phpseclib Critical AES Information Disclosure and DoS USN-8830

Linuxsecurity •LinuxSecurity Advisories • September 29, 2026

CISA confirms exploitation of a Linux firewall flaw. Check if your systems need the fix. ×

Several security issues were fixed in phpseclib. Software Description: - php-phpseclib: implementations of an arbitrary-precision integer arithmetic library Details: It was discovered that phpseclib did not perform constant-time padding validation when using AES in CBC mode. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2026-32935) It was discovered that phpseclib did not use a constant-time comparison when validating SSH packet authentication codes. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2026-40194) It was discovered that phpseclib did not properly limit object identifier lengths when parsing ASN.1 data. An attacker could possibly use this issue to cause phpseclib to use excessive resources, leading to a denial of service. (CVE-2026-44167)

Several security issues were fixed in phpseclib.

Software Description:

- php-phpseclib: implementations of an arbitrary-precision integer arithmetic library

It was discovered that phpseclib did not perform constant-time padding

validation when using AES in CBC mode. A remote attacker could possibly

use this issue to obtain sensitive information. (CVE-2026-32935)

It was discovered that phpseclib did not use a constant-time comparison

when validating SSH packet authentication codes. A remote attacker could

possibly use this issue to obtain sensitive information. (CVE-2026-40194)

It was discovered that phpseclib did not properly limit object identifier

lengths when parsing ASN.1 data. An attacker could possibly use this issue

to cause phpseclib to use excessive resources, leading to a denial of

service. (CVE-2026-44167)

The problem can be corrected by updating your system to the following package versions: Ubuntu 26.04 LTS php-phpseclib 2.0.51-1ubuntu0.1~esm1 Available with Ubuntu Pro Ubuntu 24.04 LTS php-phpseclib 2.0.47-1ubuntu0.1~esm1 Available with Ubuntu Pro Ubuntu 22.04 LTS php-phpseclib 2.0.36-1ubuntu0.1~esm3 Available with Ubuntu Pro Ubuntu 20.04 LTS php-phpseclib 2.0.23-2ubuntu0.1~esm3 Available with Ubuntu Pro Ubuntu 18.04 LTS php-phpseclib 2.0.9-1ubuntu0.1~esm3 Available with Ubuntu Pro Ubuntu 16.04 LTS php-phpseclib 2.0.1-1ubuntu0.1~esm1 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes.

CVE-2026-32935, CVE-2026-40194, CVE-2026-44167

Ubuntu Security Notice USN-8830-1

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical phpseclib Vulnerabilities Expose Sensitive Data and Cause DoS Multiple vulnerabilities were discovered in phpseclib, a library for arbitrary-precision integer arithmetic. Notably, CVE-2026-32935 involves a lack of constant-time padding validation in AES CBC mode, potentially allowing remote attackers to obtain sensitive information. CVE-2026-40194 highlights a similar issue with SSH packet authentication codes, also risking data exposure. Additionally, CVE-2026-44167 permits attackers to exploit improper object identifier length limitations, leading to denial of service conditions. These vulnerabilities affect various Ubuntu versions, including 16.04 to 26.04 LTS. Users are advised to update their systems to mitigate risks. The vulnerabilities were disclosed between March and May 2026, with patches available through standard system updates. 2 sources 46

Extracted Entities

Ubuntu phpseclib Critical AES Information Disclosure and DoS USN-8830

The full story

Extracted Entities

Attack Types (2)

Companies (1)

CVEs (3)

CWE Weaknesses (1)