CVE-2026-32935CWE-208

phpseclib's AES-CBC unpadding susceptible to padding oracle timing attack

High · published March 20, 2026

CVSS v4.0
8.2
EPSS
0%
Percentile
36.8
In the wild
Unconfirmed
What it is

phpseclib is a PHP secure communications library. Projects using versions 0.1.1 through 1.0.26, 2.0.0 through 2.0.51, and 3.0.0 through 3.0.49 are vulnerable to a to padding oracle timing attack when using AES in CBC mode. This issue has been fixed in versions 1.0.27, 2.0.52 and 3.0.50.

The record
Technical detail
CVSS v4.0
8.2 · HIGH
Vector
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00436 · 36.8th percentile
Weakness
CWE-208 · Observable Timing Discrepancy
Published
2026-03-20T02:48Z
EPSS history
Timeline
  • 20 MAR 02:48Z
    phpseclib's AES-CBC unpadding susceptible to padding oracle timing attack
    cvelistv5