CVE-2026-40194

OVERVIEW CVE-2026-40194 affects phpseclib, a widely-used PHP secure communications library, in versions prior to 3.0.51, 2.0.53, and 1.0.28. The vulnerability exists in the SSH2::get_binary_packet() function, which uses PHP's inequality operator (!=) to compare received SSH packet HMACs against locally computed values. This comparison method creates a timing side-channel vulnerability due to PHP's use of memcmp() for binary string comparison, which short-circuits on the first differing byte and enables variable-time analysis. SEVERITY The vulnerability carries a CVSS score of 3.7 (LOW) with a network attack vector, high attack complexity, no privilege requirements, and no user interaction needed. Impact is limited to confidentiality, with no integrity or availability implications. The attack requires specific timing analysis capabilities, making exploitation difficult in real-world scenarios. The EPSS score of 0.00013 indicates very low probability of exploitation compared to other published vulnerabilities. EXPLOITATION STATUS There is no evidence of active exploitation, as indicated by the vulnerability's absence from CISA's Known Exploited Vulnerabilities (KEV) catalog and its inactive status on security hot lists. No publicly available exploit code has been identified. The minimal EPSS score and low community attention suggest this timing-based vulnerability is not currently a practical security concern despite its theoretical nature.