What is GHSA-2f25-pfq3-c7h8?

GHSA-2f25-pfq3-c7h8 is a security advisory published by GitHub Security Advisories with High severity. Phpseclib needs guardrails on large binaryfield integers

Which CVE IDs does GHSA-2f25-pfq3-c7h8 cover?

GHSA-2f25-pfq3-c7h8 covers the following CVE IDs: CVE-2023-49316. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-2f25-pfq3-c7h8?

GHSA-2f25-pfq3-c7h8 has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-2f25-pfq3-c7h8?

GHSA-2f25-pfq3-c7h8 affects 1 product, including: composer/phpseclib/phpseclib:\u003e= 3.0.0, \u003c 3.0.34.

GHSA-2f25-pfq3-c7h8HighCVSS 7.5

Phpseclib needs guardrails on large binaryfield integers

Vendor

GitHub Security Advisories

Published

May 8, 2026

Last Modified

May 8, 2026

🔗 CVE IDs covered (1)

CVE-2023-49316 →

📋 Description

Impact

Anyone loading untrusted ASN1 files (eg. X509 certificates, RSA PKCS8 private or public keys, etc)

Patches

https://github.com/phpseclib/phpseclib/commit/964d78101a70305df33f442f5490f0adb3b7e77f

Workarounds

No.

References

https://github.com/phpseclib/phpseclib/commit/964d78101a70305df33f442f5490f0adb3b7e77f https://www.usenix.org/system/files/usenixsecurity25-shi-bing.pdf

🎯 Affected products1

composer/phpseclib/phpseclib:>= 3.0.0, < 3.0.34

🔗 References (6)

https://github.com/phpseclib/phpseclib/security/advisories/GHSA-2f25-pfq3-c7h8
https://nvd.nist.gov/vuln/detail/CVE-2023-49316
https://github.com/phpseclib/phpseclib/commit/964d78101a70305df33f442f5490f0adb3b7e77f
https://github.com/FriendsOfPHP/security-advisories/blob/master/phpseclib/phpseclib/CVE-2023-49316.yaml
https://github.com/phpseclib/phpseclib/releases/tag/3.0.34
https://github.com/advisories/GHSA-2f25-pfq3-c7h8