SB2026041033 - Information Exposure Through Timing Discrepancy in phpseclib

Description

This security bulletin contains information about 1 vulnerability.

1) Information Exposure Through Timing Discrepancy (CVE-ID: CVE-2026-40194)

CWE-ID: CWE-208 - Information Exposure Through Timing Discrepancy

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote attacker to disclose limited security-sensitive information via a timing side channel.

The vulnerability exists due to observable timing discrepancy in SSH2::get_binary_packet() in phpseclib/Net/SSH2.php when verifying received SSH packet HMAC values. A remote attacker can send specially crafted SSH packets to disclose limited security-sensitive information via a timing side channel.

The vulnerable code path is reached for non-AEAD cipher and MAC combinations, while AEAD cipher modes use a different authentication path.

Remediation

Install update from vendor's website.

References

• https://github.com/phpseclib/phpseclib/security/advisories/GHSA-r854-jrxh-36qx
• https://github.com/advisories/GHSA-r854-jrxh-36qx