PT-2024-21844 · Phpseclib+3 · Phpseclib+3

Published 2023-08-25 · Updated 2026-06-01 · CVE-2024-27355

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions phpseclib versions 1.x through 1.0.22 phpseclib versions 2.x through 2.0.46 phpseclib versions 3.x through 3.0.35

Description An issue was discovered in phpseclib when processing the ASN.1 object identifier of a certificate. A sub identifier may be provided that leads to a denial of service due to CPU consumption for decodeOID.

Recommendations For phpseclib versions 1.x through 1.0.22, update to version 1.0.23 or later. For phpseclib versions 2.x through 2.0.46, update to version 2.0.47 or later. For phpseclib versions 3.x through 3.0.35, update to version 3.0.36 or later.

Exploit

Fix

DoS

Resource Exhaustion

RCE

Weakness Enumeration

CWE-400

CWE-20

Related Identifiers

BDU:2025-05131

CVE-2024-27355

DLA-3749-1

DLA-3750-1

GHSA-F2QX-66WF-WVVX

GHSA-JR22-8QGM-4Q87

OPENSUSE-SU-2026:10920-1

USN-7404-1

Affected Products

Linuxmint

Red Os

Ubuntu

Phpseclib

References · 36

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/phpseclib/phpseclib/CVE-2024-27355.yaml · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-27355 · Security Note
• https://ubuntu.com/security/notices/USN-7404-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-05131 · Security Note
• https://ubuntu.com/security/CVE-2024-27355 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-30130 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10920-1 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3749-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-27355 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-27355 · Security Note
• https://osv.dev/vulnerability/DLA-3750-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-27355 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-52892 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-f2qx-66wf-wvvx · Vendor Advisory
• https://osv.dev/vulnerability/USN-7404-1 · Vendor Advisory