HighGHSA-2f25-pfq3-c7h8CVE-2023-49316
Phpseclib needs guardrails on large binaryfield integers
Published 8 May 2026 · Updated 8 May 2026
Affected package
phpseclib/phpseclibComposer
- Affected
- >=3.0.0 <3.0.34
- Fixed in
- 3.0.34
Update to the fixed version for your release line, for example:
composer require phpseclib/phpseclib:^3.0.34Details
Impact
Anyone loading untrusted ASN1 files (eg. X509 certificates, RSA PKCS8 private or public keys, etc)
Patches
https://github.com/phpseclib/phpseclib/commit/964d78101a70305df33f442f5490f0adb3b7e77f
Workarounds
No.
References
https://github.com/phpseclib/phpseclib/commit/964d78101a70305df33f442f5490f0adb3b7e77f https://www.usenix.org/system/files/usenixsecurity25-shi-bing.pdf
Is GHSA-2f25-pfq3-c7h8 in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected phpseclib/phpseclib, and gives you the command that fixes it.
References
- Linkgithub.com/phpseclib/phpseclib/security/advisories/GHSA-2f25-pfq3-c7h8
- Advisorynvd.nist.gov/vuln/detail/CVE-2023-49316
- Linkgithub.com/phpseclib/phpseclib/commit/964d78101a70305df33f442f5490f0adb3b7e77f
- Linkgithub.com/FriendsOfPHP/security-advisories/blob/master/phpseclib/phpseclib/CVE-2023-49316.yaml
- Packagegithub.com/phpseclib/phpseclib
- Linkgithub.com/phpseclib/phpseclib/releases/tag/3.0.34
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.