{"id":"CVE-2026-44167","aliases":["GHSA-3qpq-r242-jqj7"],"url":"https://o3.security/vulnerability/CVE-2026-44167","summary":"phpseclib: CVE-2024-27355 mitigation bypass — OID amplification DoS in ASN1::decodeOID()","details":"phpseclib is a PHP secure communications library. Prior to 1.0.29, 2.0.54, and 3.0.52, anyone loading untrusted ASN1 files (eg. X509 certificates, RSA PKCS8 private or public keys, etc). This is a bypass of CVE-2024-27355. This vulnerability is fixed in 1.0.29, 2.0.54, and 3.0.52.","published":"2026-05-12T17:22:14.764Z","modified":"2026-08-12T03:51:20.638500666Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"epss":{"score":0.00201,"percentile":0.09854,"asOf":"2026-08-24"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"phpseclib/phpseclib","fixedVersion":"1.0.29"},{"ecosystem":"Packagist","name":"phpseclib/phpseclib","fixedVersion":"2.0.54"},{"ecosystem":"Packagist","name":"phpseclib/phpseclib","fixedVersion":"3.0.52"}],"fix":{"url":"https://github.com/phpseclib/phpseclib/commit/d53d2021bcb9f6a04d5d44ec99e6bbef219a71bc","label":"phpseclib/phpseclib@d53d202"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44167.json"},{"type":"ADVISORY","url":"https://github.com/phpseclib/phpseclib/security/advisories/GHSA-3qpq-r242-jqj7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44167"},{"type":"FIX","url":"https://github.com/phpseclib/phpseclib/commit/d53d2021bcb9f6a04d5d44ec99e6bbef219a71bc"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:20.638500666Z"}}