[From nobody Mon Mar 23 09:07:06 2026
Received: (at submit) by bugs.debian.org; 21 Mar 2026 19:11:53 +0000
X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02
 (2024-03-25) on buxtehude.debian.org
X-Spam-Level: 
X-Spam-Status: No, score=-30.9 required=4.0 tests=BAYES_00,
 BODY_INCLUDES_CONTROL_REASSIGN,BODY_INCLUDES_CONTROL_RETITLE,FOURLA,
 FROMDEVELOPER,MD5_SHA1_SUM,NO_RELAYS,XMAILER_REPORTBUG autolearn=ham
 autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02
X-Spam-Bayes: score:0.0000 Tokens: new, 30; hammy, 141; neutral, 36; spammy,
 2. spammytokens:0.942-+--H*r:bugs.debian.org, 0.929-+--communications
 hammytokens:0.000-+--H*F:U*carnil, 0.000-+--XDebbugsCc,
 0.000-+--X-Debbugs-Cc, 0.000-+--HTo:N*Debian, 0.000-+--H*Ad:N*Bug
Return-path: <carnil@debian.org>
Received: via submission by buxtehude.debian.org with esmtp (Exim 4.96)
 (envelope-from <carnil@debian.org>) id 1w41jj-008C0S-2w
 for submit@bugs.debian.org; Sat, 21 Mar 2026 19:11:53 +0000
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
From: Salvatore Bonaccorso <carnil@debian.org>
To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: php-phpseclib3: CVE-2026-32935
Message-ID: <177412031092.2372346.8839483028002266488.reportbug@eldamar.lan>
X-Mailer: reportbug 13.2.0
Date: Sat, 21 Mar 2026 20:11:50 +0100
Delivered-To: submit@bugs.debian.org

Source: php-phpseclib3
Version: 3.0.49-1
Severity: important
Tags: security upstream
X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>
Control: clone -1 -2 -3
Control: reassign -2 src:php-phpseclib 2.0.51-1
Control: reassign -3 src:phpseclib 1.0.24-1
Control: retitle -2 php-phpseclib: CVE-2026-32935
Control: retitle -3 phpseclib: CVE-2026-32935

Hi,

The following vulnerability was published for phpseclib.

CVE-2026-32935[0]:
| phpseclib is a PHP secure communications library. Projects using
| versions 1.0.26 and below, 2.0.0 through 2.0.51, and 3.0.0 through
| 3.0.49 are vulnerable to a to padding oracle timing attack when
| using AES in CBC mode. This issue has been fixed in versions 1.0.27,
| 2.0.52 and 3.0.50.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-32935
    https://www.cve.org/CVERecord?id=CVE-2026-32935
[1] https://github.com/phpseclib/phpseclib/security/advisories/GHSA-94g3-g5v7-q4jg
[2] https://github.com/phpseclib/phpseclib/commit/ccc21aef71eb170e9bf819b167e67d1fd9e6e788

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore
]