How severe is GHSA-5739-39v2-5754?

No CVSS score has been assigned to GHSA-5739-39v2-5754 yet. Review the advisory details and affected package list to assess your exposure.

Which packages are affected by GHSA-5739-39v2-5754?

GHSA-5739-39v2-5754 affects the following packages: web-token/jwt-library (Packagist), web-token/jwt-library (Packagist), web-token/jwt-library (Packagist). Ecosystems affected: Packagist.

How do I fix GHSA-5739-39v2-5754?

Update web-token/jwt-library to 3.4.10 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-5739-39v2-5754 is resolved across your whole dependency graph.

How do I detect GHSA-5739-39v2-5754 in my Packagist dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for web-token/jwt-library, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

How do I mitigate GHSA-5739-39v2-5754 if there is no patch (or I can't update yet)?

If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Is GHSA-5739-39v2-5754 actively exploited in the wild?

No public exploit code has been indexed for GHSA-5739-39v2-5754 yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

When was GHSA-5739-39v2-5754 published, and has it been updated?

GHSA-5739-39v2-5754 was published on June 18, 2026 and was last updated on August 31, 2026. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

🐘 Packagist

Not in CISA KEV

PHP JWT Library: RSA1_5 (RSAES-PKCS1-v1_5) decryption lacks implicit rejection, exposing a Bleichenbacher/Marvin padding oracleGHSA-5739-39v2-5754

GHSA-5739-39v2-5754 is a security vulnerability in web-token/jwt-library. A fix is available for web-token/jwt-library — see the affected versions and patch details below.

Published

Jun 18, 2026

Updated

Aug 31, 2026

Affected

3 pkgs

Patched

3 / 3

Exploits

None indexed

Exploitation data as of Aug 31, 2026 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

3 pkgs affected

🐘web-token/jwt-library🐘web-token/jwt-library🐘web-token/jwt-library

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.

Description

Impact

RSACrypt::decryptWithRSA15() (used by the RSA1_5 key-encryption algorithm) implements RSAES-PKCS1-v1_5 decryption by inspecting the padding after RSADP and throwing InvalidArgumentException as soon as the padding is malformed. It does not implement the implicit-rejection countermeasure required by RFC 3447 §7.2.2 / RFC 8017 §7.1.2 (return a deterministic pseudo-random value of the expected length on padding failure and let the downstream step fail uniformly).

From a JWE caller this yields a Bleichenbacher/Marvin padding oracle: an attacker submitting adaptively crafted encrypted_key values can distinguish (a) padding rejected, (b) padding valid but wrong CEK length, and (c) padding valid and full AEAD executed — even though JWEDecrypter returns the same false in all cases — because each path performs a measurably different amount of work, amplifiable by enlarging the ciphertext (CWE-208 timing side channel). Enough adaptive queries can recover the wrapped CEK.

Affected configurations

Applications that register RSA1_5 in their decryption AlgorithmManager and hold an RSA private key.

Patches

PKCS#1 v1.5 decryption now performs implicit rejection: on invalid padding (or unexpected recovered length) it returns a random CEK of the expected size selected in constant time, so the full content-decryption (AEAD) step always runs and fails uniformly, removing the observable difference between padding-valid and padding-invalid ciphertexts. Users are still strongly encouraged to migrate to RSA-OAEP.

Workarounds

Prefer RSA-OAEP/RSA-OAEP-256; do not enable RSA1_5 for untrusted tokens.

References

RFC 3447 §7.2.2 / RFC 8017 §7.1.2
Bleichenbacher (1998); Marvin attack
CWE-208: Observable Timing Discrepancy

Résolution

Un correctif a été préparé sur une branche dédiée basée sur 3.4.x, avec des tests anti-régression dédiés (fork privé temporaire de cette advisory, PR #1).

RSA1_5 — déchiffrement PKCS#1 v1.5 avec implicit rejection en temps constant (RFC 3447 §7.2.2) : un padding invalide n'est plus distinguable d'un padding valide, neutralisant l'oracle Bleichenbacher.

Validation : php -l OK, PHPUnit vert, aucune nouvelle erreur PHPStan introduite (différentiel nul vs 3.4.x), aucun commentaire ajouté dans le code source. Après merge, cascade prévue 3.4.x → 4.0.x → 4.1.x.

Affected Packages

3 total 3 fixed

Ecosystem	Package	Vulnerable range	Fix
🐘Packagist	`web-token/jwt-library`	all versions	3.4.10`composer require web-token/jwt-library:^3.4.10`
🐘Packagist	`web-token/jwt-library`	≥ 4.0.0&&< 4.0.7	4.0.7`composer require web-token/jwt-library:^4.0.7`
🐘Packagist	`web-token/jwt-library`	≥ 4.1.0&&< 4.1.7	4.1.7`composer require web-token/jwt-library:^4.1.7`

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for web-token/jwt-library, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update web-token/jwt-library to 3.4.10 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-5739-39v2-5754 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Frequently Asked Questions

### Impact `RSACrypt::decryptWithRSA15()` (used by the `RSA1_5` key-encryption algorithm) implements RSAES-PKCS1-v1_5 decryption by inspecting the padding after RSADP and throwing `InvalidArgumentException` as soon as the padding is malformed. It does **not** implement the implicit-rejection countermeasure required by RFC 3447 §7.2.2 / RFC 8017 §7.1.2 (return a deterministic pseudo-random value of the expected length on padding failure and let the downstream step fail uniformly). From a JWE caller this yields a Bleichenbacher/Marvin padding oracle: an attacker submitting adaptively crafted `

O3 Security · Impact-Aware SCA

Is GHSA-5739-39v2-5754 in your dependencies?

Find it across Packagist, including transitive dependencies.

Scan my dependencies How O3 SCA works

PHP JWT Library: RSA1_5 (RSAES-PKCS1-v1_5) decryption lacks implicit rejection, exposing a Bleichenbacher/Marvin padding oracleGHSA-5739-39v2-5754

Real-World Exposure

Description

Impact

Affected configurations

Patches

Workarounds

References

Résolution

Affected Packages

Detection & mitigation playbook

Detect

Fix

Workarounds

Frequently Asked Questions

Is GHSA-5739-39v2-5754 in your dependencies?