UBUNTU-CVE-2026-84308

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2026-84308

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-84308.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-84308

Upstream

CVE-2026-84308

Published

2026-09-01T20:17:00Z

Modified

2026-09-16T11:43:10Z

Severity

6.3 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
Ubuntu - medium

Summary

[none]

Details

phpseclib is a PHP secure communications library. Prior to 3.0.57 and 4.0.1, pure-PHP X25519 scalar multiplication in phpseclib/Math/PrimeField/Integer.php performs data-dependent conditional modular reductions in add() and subtract(). During the Montgomery ladder in phpseclib/Crypt/EC/BaseCurves/Montgomery.php, the reduction behavior of each step depends on the secret scalar prefix, creating per-step timing and libgmp call-count observations that can reveal a reused 251-bit clamped private scalar. The phpseclib/Crypt/EC/Formats/Keys/MontgomeryPrivate.php derivation path invokes the pure-PHP multiplication without a native-engine check, while phpseclib/Crypt/EC/Formats/Keys/PKCS8.php reaches it when ext-sodium is unavailable. Exploitation requires a reused or long-lived X25519 private key, knowledge of the corresponding public key, execution of the pure-PHP path, and a local observer capable of resolving individual ladder steps or libgmp entry-point calls. Ephemeral X25519 keys, including phpseclib's normal SSH exchange path, are not affected. Recovery of the scalar permanently compromises operations that reuse that key. This issue is fixed in versions 3.0.57 and 4.0.1.

References

Affected packages

Ubuntu:24.04:LTS

php-phpseclib

Package

Name: php-phpseclib
Purl: pkg:deb/ubuntu/php-phpseclib?arch=source&distro=noble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.0.44-1

2.0.45-1

2.0.46-1

2.0.47-1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "php-phpseclib",
            "binary_version": "2.0.47-1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-84308.json"

php-phpseclib3

Package

Name: php-phpseclib3
Purl: pkg:deb/ubuntu/php-phpseclib3?arch=source&distro=noble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

3.*

3.0.21-2

3.0.33-1

3.0.34-1

3.0.35-1

3.0.37-1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "php-phpseclib3",
            "binary_version": "3.0.37-1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-84308.json"

Ubuntu:26.04:LTS

php-phpseclib

Package

Name: php-phpseclib
Purl: pkg:deb/ubuntu/php-phpseclib?arch=source&distro=resolute

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.0.48-3

2.0.49-1

2.0.51-1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "php-phpseclib",
            "binary_version": "2.0.51-1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-84308.json"

php-phpseclib3

Package

Name: php-phpseclib3
Purl: pkg:deb/ubuntu/php-phpseclib3?arch=source&distro=resolute

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

3.*

3.0.43-2

3.0.44-1

3.0.47-1

3.0.49-1

3.0.49-1ubuntu1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "php-phpseclib3",
            "binary_version": "3.0.49-1ubuntu1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-84308.json"

Ubuntu:Pro:16.04:LTS

php-phpseclib

Package

Name: php-phpseclib
Purl: pkg:deb/ubuntu/php-phpseclib?arch=source&distro=esm-apps%2Fxenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.0.1-1

2.0.1-1build1

2.0.1-1ubuntu0.1~esm2

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "php-phpseclib",
            "binary_version": "2.0.1-1ubuntu0.1~esm2"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-84308.json"

phpseclib

Package

Name: phpseclib
Purl: pkg:deb/ubuntu/phpseclib?arch=source&distro=esm-apps-legacy%2Fxenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

0.*

0.3.10-3

1.*

1.0.0-2

1.0.0-3

1.0.1-1

1.0.1-3

1.0.1-3ubuntu0.1

1.0.1-3ubuntu0.1+esm1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "php-seclib",
            "binary_version": "1.0.1-3ubuntu0.1+esm1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-84308.json"

Ubuntu:Pro:18.04:LTS

php-phpseclib

Package

Name: php-phpseclib
Purl: pkg:deb/ubuntu/php-phpseclib?arch=source&distro=esm-apps%2Fbionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.0.6-1

2.0.7-1

2.0.9-1

2.0.9-1ubuntu0.1~esm2

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "php-phpseclib",
            "binary_version": "2.0.9-1ubuntu0.1~esm2"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-84308.json"

phpseclib

Package

Name: phpseclib
Purl: pkg:deb/ubuntu/phpseclib?arch=source&distro=esm-apps%2Fbionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.0.7-1

1.0.8-1

1.0.9-1

1.0.9-1ubuntu0.1~esm1

1.0.9-1ubuntu0.1~esm2

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "php-seclib",
            "binary_version": "1.0.9-1ubuntu0.1~esm2"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-84308.json"

Ubuntu:Pro:20.04:LTS

php-phpseclib

Package

Name: php-phpseclib
Purl: pkg:deb/ubuntu/php-phpseclib?arch=source&distro=esm-apps%2Ffocal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.0.21-2

2.0.23-2

2.0.23-2ubuntu0.1~esm2

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "php-phpseclib",
            "binary_version": "2.0.23-2ubuntu0.1~esm2"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-84308.json"

phpseclib

Package

Name: phpseclib
Purl: pkg:deb/ubuntu/phpseclib?arch=source&distro=esm-apps%2Ffocal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.0.16-2

1.0.18-2

1.0.18-2ubuntu0.1~esm1

1.0.18-2ubuntu0.1~esm2

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "php-seclib",
            "binary_version": "1.0.18-2ubuntu0.1~esm2"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-84308.json"

Ubuntu:Pro:22.04:LTS

php-phpseclib

Package

Name: php-phpseclib
Purl: pkg:deb/ubuntu/php-phpseclib?arch=source&distro=esm-apps%2Fjammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.0.30-2ubuntu1

2.0.34-1

2.0.35-1

2.0.36-1

2.0.36-1ubuntu0.1~esm2

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "php-phpseclib",
            "binary_version": "2.0.36-1ubuntu0.1~esm2"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-84308.json"

php-phpseclib3

Package

Name: php-phpseclib3
Purl: pkg:deb/ubuntu/php-phpseclib3?arch=source&distro=esm-apps%2Fjammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

3.*

3.0.9-1

3.0.10-1

3.0.12-2

3.0.13-1

3.0.13-1ubuntu0.1~esm1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "php-phpseclib3",
            "binary_version": "3.0.13-1ubuntu0.1~esm1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-84308.json"

phpseclib

Package

Name: phpseclib
Purl: pkg:deb/ubuntu/phpseclib?arch=source&distro=esm-apps%2Fjammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.0.19-3ubuntu2

1.0.19-3ubuntu3

1.0.20-1

1.0.20-1ubuntu0.1~esm1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "php-seclib",
            "binary_version": "1.0.20-1ubuntu0.1~esm1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-84308.json"

Ubuntu:Pro:24.04:LTS

phpseclib

Package

Name: phpseclib
Purl: pkg:deb/ubuntu/phpseclib?arch=source&distro=esm-apps%2Fnoble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.0.21-2

1.0.22-1

1.0.23-1

1.0.23-1ubuntu0.1~esm1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "php-seclib",
            "binary_version": "1.0.23-1ubuntu0.1~esm1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-84308.json"

Ubuntu:Pro:26.04:LTS

phpseclib

Package

Name: phpseclib
Purl: pkg:deb/ubuntu/phpseclib?arch=source&distro=esm-apps%2Fresolute

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.0.23-6

1.0.24-1

1.0.24-1ubuntu0.1~esm1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "php-seclib",
            "binary_version": "1.0.24-1ubuntu0.1~esm1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-84308.json"