GHSA-3qpq-r242-jqj7

phpseclib has a CVE-2024-27355 mitigation bypass — OID amplification DoS in ASN1::decodeOID()

Source: GitHub Advisory Database (reviewed) High CVE-2026-44167

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	phpseclib/phpseclib	>= 0.1.1, < 1.0.29	1.0.29
Packagist	phpseclib/phpseclib	>= 2.0.0, < 2.0.54	2.0.54
Packagist	phpseclib/phpseclib	>= 3.0.0, < 3.0.52	3.0.52

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact Anyone loading untrusted ASN1 files (eg. X509 certificates, RSA PKCS8 private or public keys, etc) ### Patches https://github.com/phpseclib/phpseclib/commit/d53d2021bcb9f6a04d5d44ec99e6bbef219a71bc ### Workarounds No. ### References https://github.com/phpseclib/phpseclib/commit/d53d2021bcb9f6a04d5d44ec99e6bbef219a71bc

References

External links from the advisory. They lead to third-party sites.

https://github.com/phpseclib/phpseclib/security/advisories/GHSA-3qpq-r242-jqj7 web
https://nvd.nist.gov/vuln/detail/CVE-2026-44167 advisory
https://github.com/phpseclib/phpseclib/commit/d53d2021bcb9f6a04d5d44ec99e6bbef219a71bc web
https://github.com/phpseclib/phpseclib package