Listen to this Post
CVE-2026-84308 is a vulnerability in the phpseclib PHP secure communications library. Prior to versions 3.0.57 and 4.0.1, the pure-PHP X25519 scalar multiplication implementation is not constant-time. This is due to the `add()` and `subtract()` methods in `Math/PrimeField/Integer.php` performing data-dependent conditional modular reductions. During the Montgomery ladder in Crypt/EC/BaseCurves/Montgomery.php, the reduction behavior of each step depends on the secret scalar prefix.
This dependency creates per-step timing and libgmp call-count variations that can be observed by an attacker. An observer with per-ladder-step resolution can recover the 251-bit clamped private scalar. The leak is per-step, not aggregate, and an instrumented proof-of-concept recovers 20/20 test keys from 32 observed operations. An observer that counts libgmp calls can recover a key from a single operation.
This is not a low-order-input issue; recovery works with the RFC 7748 base point u = 9, with no attacker-chosen input. Rejecting low-order public values does not close the vulnerability. Exploitation requires a reused or long-lived X25519 private key, knowledge of the corresponding public key, execution of the pure-PHP path, and a local observer capable of resolving individual ladder steps or libgmp entry-point calls. Ephemeral X25519 keys, including phpseclib’s normal SSH exchange path, are not affected. Recovery of the scalar permanently compromises operations that reuse that key.
DailyCVE Form:
Platform: phpseclib 3.0.x
Version: 3.0.56 and below
Vulnerability: Timing Side-Channel
Severity: Medium (CVSS 6.3)
Date: 2026-09-01
Prediction: Already Patched (3.0.57)
What Undercode Say:
Analytics of the vulnerability show that the attack is feasible with local co-residency. The observer needs to distinguish ~0.9 µs within a ~32 µs step, or count libgmp entry-point calls. In practice, this means a Flush+Reload spy on the shared `libgmp.so` mapping, targeting `__gmpz_add` and __gmpz_sub.
The following bash command can be used to check the phpseclib version installed via Composer:
composer show phpseclib/phpseclib | grep versions
To check if the `ext-sodium` extension is loaded (which bypasses the vulnerable pure-PHP path), use:
php -m | grep sodium
To check the GMP extension (the engine used in the vulnerable path):
php -m | grep gmp
Exploit: (Educational Purposes!)
The vulnerability lies in the data-dependent branches within Math/PrimeField/Integer.php:
– `add()` at line 189 performs a conditional `subtract($modulo)` when the sum ≥ p.
– `subtract()` at line 207 performs a conditional `add($modulo)` when the result is negative.
During each Montgomery ladder step, the number of these conditional reductions (c) is a linear function of the secret scalar’s prefix. The per-step cost is α + β·c, where β = 838–920 ns.
An attacker can observe these variations. A beam search replays both branches from each candidate ladder state, reads off the exact c for each, and scores against the observation. The victim’s public key adjudicates the small residual search.
A proof-of-concept exploit would:
- Capture per-step timing or libgmp call counts from the target process.
- Use a beam search decoder to reconstruct the scalar prefix.
3. Recover the full 251-bit clamped private scalar.
- Use the recovered scalar to compromise any operation that reuses the key.
Protection:
The primary protection is to upgrade phpseclib to version 3.0.57 or 4.0.1.
If an upgrade is not immediately possible:
- Enable the native Sodium engine in PHP or ensure `ext-sodium` is available to bypass the pure-PHP path.
- Avoid reusing X25519 private keys — rotate keys frequently and use ephemerally generated keys for SSH exchanges.
- Consider disabling the pure-PHP X25519 implementation or restricting its use to highly trusted contexts.
A code-level fix involves making the field arithmetic constant-time, or delegating to a vetted native provider. Simply removing the ladder’s bit branch is insufficient while the operand-dependent reductions in `Integer.php` remain.
Impact:
In the instrumented, local model, recovery of the clamped scalar gives a permanent compromise of the X25519 private key. Clamping is applied on every call, so the recovered value is what every past and future operation with that key uses. This can lead to decryption of past communications, impersonation, and man-in-the-middle attacks.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
