phpseclib/phpseclib

PHP Secure Communications Library - Pure-PHP implementations of RSA, AES, SSH2, SFTP, X.509 etc.

Latest 4.0.2

88%

Total Score

healthy

Long-term active maintenance and strong project hygiene outweigh concentrated commits and six unpinned workflow actions.

Are you affected? Scan for Free

Health Score Breakdown

Repo bus factor

One contributor made 97 of 113 commits, or about 86%, which creates continuity risk. However, nine other contributors were active and the repository is organization-owned, providing some handoff capacity.

Workflow audit

All workflows were analyzed successfully, use read-only permissions, and had no untrusted checkout or script-injection findings. However, all six action references are unpinned, which weakens build reproducibility and supply-chain hygiene.

Vulnerabilities

Title	Versions	Severity
AIKIDO-2026-730961 phpseclib/phpseclib is vulnerable to Observable Timing Discrepancy in versions 3.0.0 - 3.0.56 and 4.0.0 - 4.0.0.	3.0.0 - 3.0.564.0.0 - 4.0.0	Medium
CVE-2026-55599 phpseclib/phpseclib is vulnerable to Server-Side Request Forgery (SSRF) in versions 0.1.1 - 1.0.29, 2.0.0 - 2.0.54 and 3.0.0 - 3.0.53.	0.1.1 - 1.0.292.0.0 - 2.0.543.0.0 - 3.0.53	Medium
CVE-2023-49316 phpseclib/phpseclib is vulnerable to Uncontrolled Resource Consumption in versions 3.0.0 - 3.0.34.	3.0.0 - 3.0.34	High
CVE-2024-27355 phpseclib/phpseclib is vulnerable to Uncontrolled Resource Consumption in versions 2.0.0 - 2.0.46, 3.0.0 - 3.0.35 and 0.1.1 - 1.0.22.	0.1.1 - 1.0.222.0.0 - 2.0.463.0.0 - 3.0.35	High
CVE-2024-27354 phpseclib/phpseclib is vulnerable to Uncontrolled Resource Consumption in versions 0.1.1 - 1.0.23, 2.0.0 - 2.0.47 and 3.0.0 - 3.0.36.	0.1.1 - 1.0.232.0.0 - 2.0.473.0.0 - 3.0.36	High