CVE-2026-44167CWE-400

phpseclib: CVE-2024-27355 mitigation bypass — OID amplification DoS in ASN1::decodeOID()

High · published May 12, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
26.0
In the wild
Unconfirmed
What it is

phpseclib is a PHP secure communications library. Prior to 1.0.29, 2.0.54, and 3.0.52, anyone loading untrusted ASN1 files (eg. X509 certificates, RSA PKCS8 private or public keys, etc). This is a bypass of CVE-2024-27355. This vulnerability is fixed in 1.0.29, 2.0.54, and 3.0.52.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00338 · 26.0th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2026-05-12T17:22Z
EPSS history
Timeline
  • 12 MAY 17:22Z
    phpseclib: CVE-2024-27355 mitigation bypass — OID amplification DoS in ASN1::decodeOID()
    cvelistv5