Alerts This Week
Warning Icon 1 975
Alerts This Week
Warning Icon 1 975

Debian php-phpseclib Vulnerability DSA-6186-1 Critical Timing Attack Issue

debian
Calendar Grey March 29, 2026
Debian Logo
AES-CBC implementation in php-phpseclib is vulnerable to padding oracle timing attacks. Upgrade to secure your system now!
It was discovered that the AES-CBC implementation in the PHP Secure Communications Library was susceptible to a padding oracle timing attack
Topics%20covered

Topics Covered

security advisory debian timing attack padding oracle php-phpseclib CVE-2023-52892

Summary

For the oldstable distribution (bookworm), these problems have been fixed
in version 2.0.42-1+deb12u3. This update also fixes CVE-2023-52892.

For the stable distribution (trixie), these problems have been fixed in
version 2.0.48-3+deb13u1.

We recommend that you upgrade your php-phpseclib packages.

For the detailed security status of php-phpseclib please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/source-package/php-phpseclib

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/



Severity
critical
Lowest
Low
Medium
High
Critical

Package: php-phpseclib
CVE ID: CVE-2026-32935

Topics%20covered

Topics Covered

security advisory debian timing attack padding oracle php-phpseclib CVE-2023-52892

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here