CVE-2026-44167

phpseclib is a PHP secure communications library. Prior to 1.0.29, 2.0.54, and 3.0.52, anyone loading untrusted ASN1 files (eg. X509 certificates, RSA PKCS8 private or public keys, etc). This is a bypass of CVE-2024-27355. This vulnerability is fixed in 1.0.29, 2.0.54, and 3.0.52.

• CWE-400

• https://github.com/phpseclib/phpseclib/commit/d53d2021bcb9f6a04d5d44ec99e6bbef219a71bc
• https://github.com/phpseclib/phpseclib/security/advisories/GHSA-3qpq-r242-jqj7

Published

May 12, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-4415Gigabyte Control Center developed by GIGABYTE has an Arbitra…9.8
• CVE-2026-44159Tyler Identity Local (TID-L) uses documented, default admini…9.8
• CVE-2026-4416The Performance Library component of Gigabyte Control Center…8.5
• CVE-2026-44160Fluentd collects events from various data sources and writes…7.5
• CVE-2026-44161Fluentd collects events from various data sources and writes…7.2
• CVE-2026-44166Pocketbase is an open source web backend written in go. Prio…7.6
• CVE-2026-44168MariaDB server is a community developed fork of MySQL server…8
• CVE-2026-44169MariaDB server is a community developed fork of MySQL server…4.3
• CVE-2026-44170MariaDB server is a community developed fork of MySQL server…9.8
• CVE-2026-44171MariaDB server is a community developed fork of MySQL server…7.8
• CVE-2026-44172MariaDB server is a community developed fork of MySQL server…9.1
• CVE-2026-44173MariaDB server is a community developed fork of MySQL server…5.3