CVE-2026-84308: phpseclib Vulnerability in X25519 Scalar Multiplication Allows Private-Key Recovery
Summary
CVE-2026-84308: phpseclib — non-constant-time X25519 scalar multiplication permits full private-key recovery. Affects phpseclib across 2 version ranges.
< 3.0.57
>= 4.0.0, < 4.0.1
Fixed in 3.0.57 or 4.0.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpseclib is a pure-PHP implementation of various cryptographic algorithms, including public key cryptography. It provides an easy-to-use interface for developers to implement secure communications in their applications. However, a vulnerability in its X25519 scalar multiplication implementation has been identified, which can lead to the recovery of private keys under certain conditions.
Vulnerability Detail
The vulnerability arises from the non-constant-time implementation of X25519 scalar multiplication in phpseclib. Specifically, the field addition and subtraction operations perform data-dependent conditional modular reductions, allowing an observer to recover the 251-bit clamped private scalar. This can be exploited through timing attacks or by counting specific function calls, making it possible to recover the private key with as few as one operation in some cases. The vulnerability is not limited to low-order inputs, as it can be exploited with the RFC 7748 base point 'u = 9', which does not require attacker-chosen inputs.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 3.0.573.0.57composer require phpseclib:3.0.57 -
>= 4.0.0, < 4.0.14.0.1composer require phpseclib:4.0.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, avoid using the pure-PHP implementation of X25519 scalar multiplication by ensuring that your application uses the sodium or OpenSSL extensions, which are not affected by this vulnerability. You can enforce the use of these extensions in your code by checking for their availability before executing cryptographic operations.
Conclusion
The vulnerability in phpseclib's X25519 scalar multiplication implementation poses a significant risk of private key recovery through timing attacks. It is crucial for developers using this library to update to the patched versions or implement workarounds to mitigate the risk. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for phpseclib →
FAQ
The vulnerability allows an attacker to recover the private key used in X25519 operations, which can lead to a complete compromise of the cryptographic security of the application.
You can use Vulert, which monitors open-source vulnerabilities in your software. By analyzing your composer.lock file, Vulert can alert you to any vulnerabilities, including this one.
Yes, the vulnerability has been confirmed in phpseclib version 3.0.56 and earlier. It has been patched in versions 3.0.57 and 4.0.1.
If an immediate update is not possible, consider using the sodium or OpenSSL extensions for cryptographic operations to mitigate the risk associated with this vulnerability.
The CVSS score for this vulnerability is 6.3, indicating a moderate level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for phpseclib.
