phpseclib/phpseclib security advisory

CVE-2026-84308: Phpseclib — non-constant-time X25519 scalar multiplication permits full private-key recovery

CVE-2026-84308 is a medium-severity user enumeration vulnerability in the PHP package phpseclib/phpseclib (CVSS 6.3), published 1 September 2026. It is fixed in 3.0.57 and 4.0.1, one per release line; earlier versions on each line are affected. Exploiting it needs a low-privilege user account.

medium 6.3 published 2026-09-01 · updated 2026-09-09

Affected versions: < 3.0.57
>= 4.0.0, < 4.0.1
Fixed in: 3.0.57, 4.0.1
Newest release: 4.0.3
Severity: Medium · CVSS 6.3
Type: User enumeration
CWE-208, CWE-385
Exploited in the wild: Not on the CISA KEV list
checked 2026-11-04

Is your phpseclib/phpseclib version affected?

Run composer show phpseclib/phpseclib in your project, then enter the version. We check it against this and every other known phpseclib/phpseclib advisory.

Who can exploit CVE-2026-84308

Access: A normal, low-privilege user account in the app.
Position: The attacker needs local access to the server.
Conditions: It only works under specific conditions the attacker does not fully control (CVSS rates the attack as high complexity).

CVSS vector (scored by GitHub): CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Your app is only exposed if it uses the affected part of phpseclib/phpseclib. The advisory below says which part that is. If you are not sure, upgrade anyway: it costs less than finding out.

How to fix CVE-2026-84308 in phpseclib/phpseclib

Find the installed version: composer show phpseclib/phpseclib. If you never required it yourself, composer why phpseclib/phpseclib shows which package pulls it in.
Update it: composer update phpseclib/phpseclib --with-all-dependencies. You need the fixed version for your release line (3.0.57 and 4.0.1).
If Composer will not go that high, your composer.json constraint is holding it back. Widen it (for example "phpseclib/phpseclib": "^4.0.1" if you can take that version), or upgrade the package that requires it.
Run composer audit. It reads the same advisory data and should no longer list CVE-2026-84308.
Commit composer.lock and deploy it. On the server, run composer install --no-dev from the lock file, not composer update.

If you cannot upgrade yet

General hardening for user enumeration issues while the upgrade waits. None of it replaces the fix.

Rate-limit login and password-reset endpoints and return the same response for unknown and known users.
If your app does not use the affected feature, note that in your audit, but still plan the upgrade.

The CVE-2026-84308 advisory

phpseclib is a PHP secure communications library. Prior to 3.0.57 and 4.0.1, pure-PHP X25519 scalar multiplication in phpseclib/Math/PrimeField/Integer.php performs data-dependent conditional modular reductions in add() and subtract(). During the Montgomery ladder in phpseclib/Crypt/EC/BaseCurves/Montgomery.php, the reduction behavior of each step depends on the secret scalar prefix, creating per-step timing and libgmp call-count observations that can reveal a reused 251-bit clamped private scalar. The phpseclib/Crypt/EC/Formats/Keys/MontgomeryPrivate.php derivation path invokes the pure-PHP multiplication without a native-engine check, while phpseclib/Crypt/EC/Formats/Keys/PKCS8.php reaches it when ext-sodium is unavailable. Exploitation requires a reused or long-lived X25519 private key, knowledge of the corresponding public key, execution of the pure-PHP path, and a local observer capable of resolving individual ladder steps or libgmp entry-point calls. Ephemeral X25519 keys, including phpseclib's normal SSH exchange path, are not affected. Recovery of the scalar permanently compromises operations that reuse that key. This issue is fixed in versions 3.0.57 and 4.0.1.

Description from the CVE record, published by GitHub (the CVE Numbering Authority), via the NVD entry for CVE-2026-84308. Advisory title: “phpseclib — non-constant-time X25519 scalar multiplication permits full private-key recovery”.

References

GitHub advisory GHSA-q97c-8qh3-fpc6 github.com
Fix commit fb56bc5 github.com
Release 3.0.57 github.com
Release 4.0.1 github.com

Other phpseclib/phpseclib advisories

Need help patching or upgrading? Laskyr does PHP and Laravel security fixes and upgrades. Tell us what you run and we reply with a plan and a price.

Ask about a fix

Where this data comes from

Affected and fixed versions: the Packagist security advisories API (GitHub Advisory Database and FriendsOfPHP), the same data composer audit uses. Synced 2026-11-03.
Description, score, weakness and references: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
Exploited-in-the-wild status: the CISA Known Exploited Vulnerabilities catalog, checked 2026-11-04.
Compiled by Daniel Lasek at Laskyr from the sources above. The summary, “who can exploit it”, “how to fix it” and hardening sections are our plain-English reading of the record and are generated from it. The quoted description is the record's own text. Spot an error? Tell us.