CVE-2026-84308: phpseclib — non-constant-time X25519 scalar multiplication permits full private-key recovery
The pure-PHP X25519 scalar multiplication in phpseclib is not constant-time. Field addition and subtraction each perform a data-dependent conditional modular reduction, so the cost of each Montgomery-ladder step is a linear function of that step’s reduction count which is a quantity determined by the secret scalar’s prefix.
An observer with per-ladder-step resolution recovers the 251-bit clamped private scalar. This is a per-step leak, not an aggregate one: an instrumented code proof-of-concept recovers 20/20 test keys from 32 observed operations, and an observer that counts libgmp calls instead of timing them recovers a key from a single operation.
This is not a low-order-input issue. Recovery works with the RFC 7748 base point u = 9, with no attacker-chosen input at all. Rejecting low-order public values does not close it.
References
- github.com/advisories/GHSA-q97c-8qh3-fpc6
- github.com/phpseclib/phpseclib/commit/fb56bc5bb9009b54a6c26b31aeec8ed944f17373
- github.com/phpseclib/phpseclib/releases/tag/3.0.57
- github.com/phpseclib/phpseclib/releases/tag/4.0.1
- github.com/phpseclib/phpseclib/security/advisories/GHSA-q97c-8qh3-fpc6
- nvd.nist.gov/vuln/detail/CVE-2026-84308
Code Behaviors & Features
Detect and mitigate CVE-2026-84308 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →