BlackTreeLifecycle intelligence
Evidence-linked product lifecycle intelligenceSUPPORT · SECURITY · RETIREMENT
← Lifecycle catalogue
UBUNTU SECURITY NOTICECANONICALVERIFIED

PUBLISHER UPDATE · USN-8830-1

USN-8830-1 release notes and known issues

USN-8830-1: phpseclib vulnerabilities

Scope: Ubuntu. This update record adds version, fix and known-issue context. Its publication date is not a lifecycle boundary.

Summary

It was discovered that phpseclib did not perform constant-time padding validation when using AES in CBC mode. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2026-32935) It was discovered that phpseclib did not use a constant-time comparison when validating SSH packet authentication codes. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2026-40194) It was discovered that phpseclib did not properly limit object identifier lengths when parsing ASN.1 data. An attacker could possibly use this issue to cause phpseclib to use excessive resources, leading to a denial of service. (CVE-2026-44167)

Improvements and security content

  • It was discovered that phpseclib did not perform constant-time padding validation when using AES in CBC mode. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2026-32935) It was discovered that phpseclib did not use a constant-time comparison when validating SSH packet authentication codes. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2026-40194) It was discovered that phpseclib did not properly limit object identifier lengths when parsing ASN.1 data. An attacker could possibly use this issue to cause phpseclib to use excessive resources, leading to a denial of service. (CVE-2026-44167)

Known issues

Publisher statement

Not stated. The verified publisher record does not contain a known-issues statement.

Affected products and versions

Products

  • Ubuntu

Affected versions

  • See the official publisher source for applicability.

Fixed versions or updates

  • No fixed version is stated in this record.

Recommended action

Review the official publisher document before deployment.

Related vulnerabilities

BlackTree CVE Intelligence
CVE-2026-32935Open CVE report →CVE-2026-40194Open CVE report →CVE-2026-44167Open CVE report →

These links connect the publisher update to related Lifecycle records without treating the update publication date as an end-of-support date.

Ubuntu 24.04 LTSOpen lifecycle record →

Official publisher evidence

CANONICALVERIFIED

USN-8830-1: phpseclib vulnerabilities

Checked 29 Sep 2026. BlackTree preserves the last verified facts if a later source check is temporarily unavailable.

Open the official publisher source