Denial of Service Vulnerability in phpseclib by phpseclib Development Team

CVE-2024-27354

What is CVE-2024-27354?

A vulnerability exists in versions of phpseclib prior to 1.0.23, 2.0.47, and 3.0.36 where an attacker can exploit malformed certificates that contain excessively large prime numbers. This can lead to significant CPU consumption due to prolonged primality checks, resulting in potential denial of service conditions. This issue arose as an unintended consequence of efforts to mitigate a previous vulnerability.

References