Alerts This Week
Warning Icon 1 975
Alerts This Week
Warning Icon 1 975

Debian DSA-6187-1 php-phpseclib3 Important AES-CBC Padding Oracle Attack

debian
Calendar Grey March 29, 2026
Debian Logo
Critical update for Debian php-phpseclib3 addresses padding oracle timing attack risk in AES-CBC implementation.
It was discovered that the AES-CBC implementation in the PHP Secure Communications Library was susceptible to a padding oracle timing attack
Topics%20covered

Topics Covered

security advisory update debian important padding oracle php-phpseclib3

Summary

For the oldstable distribution (bookworm), these problems have been fixed
in version 3.0.19-1+deb12u4. This update also fixes CVE-2023-52892.

For the stable distribution (trixie), these problems have been fixed in
version 3.0.43-2+deb13u1.

We recommend that you upgrade your php-phpseclib3 packages.

For the detailed security status of php-phpseclib3 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/source-package/php-phpseclib3

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/



Severity
important
Lowest
Low
Medium
High
Critical

Package: php-phpseclib3
CVE ID: CVE-2026-32935

Topics%20covered

Topics Covered

security advisory update debian important padding oracle php-phpseclib3

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here