Alerts This Week
Warning Icon 1 975
Alerts This Week
Warning Icon 1 975

Debian Oldstable phpseclib Key Padding Attack Fix DSA-6185-1 CVE-2026-32935

debian
Calendar Grey March 29, 2026
Debian Logo
The AES-CBC in phpseclib has a serious padding oracle timing attack issue. Update recommended to secure systems.
It was discovered that the AES-CBC implementation in the PHP Secure Communications Library was susceptible to a padding oracle timing attack
Topics%20covered

Topics Covered

security advisory debian important phpseclib padding attack cve-2026-32935

Summary

For the oldstable distribution (bookworm), these problems have been fixed
in version 1.0.20-1+deb12u3. This update also fixes CVE-2023-52892.

For the stable distribution (trixie), these problems have been fixed in
version 1.0.23-6+deb13u1.

We recommend that you upgrade your phpseclib packages.

For the detailed security status of phpseclib please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/source-package/phpseclib

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/



Severity
important
Lowest
Low
Medium
High
Critical

Package: phpseclib
CVE ID: CVE-2026-32935

Topics%20covered

Topics Covered

security advisory debian important phpseclib padding attack cve-2026-32935

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here