CVE-2026-84308

Received Received - Intake

Timing Side Channel in phpseclib X25519 Key Exchange

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: GitHub, Inc.

Description

phpseclib is a PHP secure communications library. Prior to 3.0.57 and 4.0.1, pure-PHP X25519 scalar multiplication in phpseclib/Math/PrimeField/Integer.php performs data-dependent conditional modular reductions in add() and subtract(). During the Montgomery ladder in phpseclib/Crypt/EC/BaseCurves/Montgomery.php, the reduction behavior of each step depends on the secret scalar prefix, creating per-step timing and libgmp call-count observations that can reveal a reused 251-bit clamped private scalar. The phpseclib/Crypt/EC/Formats/Keys/MontgomeryPrivate.php derivation path invokes the pure-PHP multiplication without a native-engine check, while phpseclib/Crypt/EC/Formats/Keys/PKCS8.php reaches it when ext-sodium is unavailable. Exploitation requires a reused or long-lived X25519 private key, knowledge of the corresponding public key, execution of the pure-PHP path, and a local observer capable of resolving individual ladder steps or libgmp entry-point calls. Ephemeral X25519 keys, including phpseclib's normal SSH exchange path, are not affected. Recovery of the scalar permanently compromises operations that reuse that key. This issue is fixed in versions 3.0.57 and 4.0.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-01

Last Modified

2026-09-01

Generated

2026-09-02

AI Q&A

2026-09-02

EPSS Evaluated

N/A

NVD

CVE-2026-84308

EUVD

EUVD-2026-69576

Affected Vendors & Products

Vendor	Product	Version / Range
phpseclib	phpseclib	to 3.0.57 (exc)
phpseclib	phpseclib	3.0.57
phpseclib	phpseclib	4.0.1
phpseclib	phpseclib	to 4.0.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-385	Covert timing channels convey information by modulating some aspect of system behavior over time, so that the program receiving the information can observe system behavior and infer protected information.
CWE-208	Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.

Attack-Flow Graph

Executive Summary

This vulnerability affects phpseclib versions 3.0.56 and 4.0.0. It involves a timing attack on X25519 scalar multiplication in the pure-PHP implementation. The issue occurs because modular reductions in field operations depend on the secret scalar, creating timing and call-count variations during the Montgomery ladder steps. An attacker can exploit these variations to recover the full private key if it is reused or long-lived.

Detection Guidance

Detection requires monitoring for timing variations or libgmp call-count anomalies during X25519 operations. Use profiling tools like strace or perf to observe system calls during cryptographic operations. Check if your phpseclib version is below 3.0.57 or 4.0.1 using composer show phpseclib/phpseclib.

Impact Analysis

If you use a reused or long-lived X25519 private key with affected phpseclib versions, an attacker could recover your private key by observing timing differences or library call counts during cryptographic operations. This would allow them to decrypt communications or impersonate you. Ephemeral keys used in normal SSH exchanges are not affected.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. If private keys are compromised, it may result in data breaches, triggering mandatory breach notifications and potential fines under these regulations.

Mitigation Strategies

Upgrade phpseclib to version 3.0.57 or 4.0.1 immediately. If upgrading is not possible, ensure native cryptographic providers like libsodium or OpenSSL are used instead of the pure-PHP implementation. Avoid reusing X25519 private keys and regenerate any potentially exposed keys.

Hi! I’m here to help you understand CVE-2026-84308. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70