CVE-2026-55599 phpseclib: X.509 certificate validation sends attacker-controlled outbound requests (server-side request forgery) via Authority Information Access
An attacker can force a server using phpseclib to make unauthorized internal network requests during X.509 certificate validation, potentially accessing sensitive internal services.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-55599?
CVE-2026-55599 is a medium-severity server-side request forgery vulnerability in phpseclib, published on 22 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
phpseclib is a PHP secure communications library. From 0.1.1 until 1.0.30, 2.0.55, and 3.0.54, when an application validates an untrusted X.509 certificate with phpseclib, X509::validateSignature() reads a URL out of that certificate's Authority Information Access (AIA) extension and connects to it. Attacker who supplies certificate fully controls host, port, and path of that connection. URL fetching is enabled by default, and no destination is blocked. An unauthenticated attacker can therefore make a validating server open connections to internal hosts and ports it should never reach, for example loopback 127.0.0.1, cloud metadata address 169.254.169.254, and internal-only services. This is a server-side request forgery (SSRF) caused by an insecure default. This vulnerability is fixed in 1.0.30, 2.0.55, and 3.0.54.
Weakness: CWE-918
Which versions are affected by CVE-2026-55599?
6 open source packages ship an affected version, including phpseclib/phpseclib. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
phpseclib/phpseclib Packagist | From 0.1.1 | 1.0.30 |
phpseclib/phpseclib Packagist | From 0.1.1 | 1.0.30 |
phpseclib/phpseclib Packagist | From 2.0.0 | 2.0.55 |
phpseclib/phpseclib Packagist | From 2.0.0 | 2.0.55 |
phpseclib/phpseclib Packagist | From 3.0.0 | 3.0.54 |
phpseclib/phpseclib Packagist | From 3.0.0 | 3.0.54 |
Products include Phpseclib Phpseclib.
How do I fix CVE-2026-55599?
Upgrade phpseclib/phpseclib to a fixed version for your release line: 1.0.30, 2.0.55 or 3.0.54.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-55599 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-55599 exists.
Other vulnerabilities in phpseclib
- CVE-2026-32935 phpseclib's AES-CBC unpadding susceptible to padding oracle timing attack
- CVE-2023-52892 Name confusion in x509 Subject Alternative Name fields
- CVE-2023-49316 Phpseclib needs guardrails on large binaryfield integers
- CVE-2023-27560 phpseclib Infinite Loop vulnerability
- CVE-2026-40194 phpseclib has a variable-time HMAC comparison in SSH2::get_binary_packet() using != instead of hash_equals()
Sources
Also known as DEBIAN-CVE-2026-55599, GHSA-m557-wrgg-6rp4, MINI-27w4-fvmx-4237, MINI-4xrp-5fg3-x828, MINI-m36r-q9v9-2x3c, UBUNTU-CVE-2026-55599.