By vendor

Phpseclib vulnerabilities

Known CVEs affecting Phpseclib products, prioritized by severity, with SEC.co remediation and detection guidance.

1 published vulnerability

• CVE-2026-55599MEDIUM 5.8

  phpseclib, a widely-used PHP library for cryptographic operations and secure communications, contains a server-side request forgery (SSRF) vulnerability in how it validates X.509 certificates. When an application uses phpseclib to validate a certificate, the library automatically fetches and connects to a URL embedded in the certificate's Authority Information Access extension—without any restrictions on where that URL points. An attacker who controls a malicious certificate can force a validating server to make connections to internal resources it should never reach, such as localhost services, cloud metadata endpoints, or internal-only infrastructure. This happens by default with no configuration required, making it a dangerous insecure default.