CVE-2026-40194

🗓️ 10 Apr 2026 20:24:06Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 54 Views

phpseclib SSH2 get_binary_packet uses != for HMAC, causing variable-time comparison; fixed in 3.0.51.

Reporter	Title	Published	Views	Family All 31
FreeBSD	cacti -- multiple vulnerabilities	16 Jun 202600:00	–	freebsd
ATTACKERKB	CVE-2026-40194	10 Apr 202620:24	–	attackerkb
AlpineLinux	CVE-2026-40194	10 Apr 202620:24	–	alpinelinux
Chainguard	CVE-2026-40194 vulnerabilities	28 Apr 202619:17	–	cgr
Circl	CVE-2026-40194	10 Apr 202622:37	–	circl
CNNVD	phpseclib 安全漏洞	10 Apr 202600:00	–	cnnvd
Cvelist	CVE-2026-40194 phpseclib has a variable-time HMAC comparison in SSH2::get_binary_packet() using != instead of hash_equals()	10 Apr 202620:24	–	cvelist
Debian	[SECURITY] [DLA 4670-1] php-phpseclib security update	4 Jul 202619:31	–	debian
Debian CVE	CVE-2026-40194	10 Apr 202620:24	–	debiancve
Tenable Nessus	Debian dla-4670 : php-phpseclib - security update	6 Jul 202600:00	–	nessus

NVD

Vulners

Node

phpseclib phpseclibRange≤1.0.27

phpseclib phpseclibRange2.0.0–2.0.53

phpseclib phpseclibRange3.0.0–3.0.51

[
  {
    "vendor": "phpseclib",
    "product": "phpseclib",
    "versions": [
      {
        "version": ">= 0.1.1, < 1.0.28",
        "status": "affected"
      },
      {
        "version": ">= 2.0.0, < 2.0.53",
        "status": "affected"
      },
      {
        "version": ">= 3.0.0, < 3.0.51",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/phpseclib/phpseclib/releases/tag/1.0.28
github	www.github.com/phpseclib/phpseclib/commit/ffe48b6b1b1af6963327f0a5330e3aa004a194ac
github	www.github.com/phpseclib/phpseclib/releases/tag/3.0.51
github	www.github.com/phpseclib/phpseclib/releases/tag/2.0.53
github	www.github.com/phpseclib/phpseclib/security/advisories/GHSA-r854-jrxh-36qx

17 Jun 2026 10:44Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.13.7

EPSS0.00334

SSVC

CWE-208