5.8

CVE-2026-55599: phpseclib Server-Side Request Forgery (SSRF)

CVSS: 5.8v3.1MediumAnalyzed
AliasesUBUNTU-CVE-2026-55599DEBIAN-CVE-2026-55599CGA-f6fp-8g8j-2w2w
Published 22-06-2026Last modified 23-06-2026
Open JSON

Vulnerability summary

CVE-2026-55599 is a medium (CVSS 5.8) Server-Side Request Forgery (SSRF) vulnerability in phpseclib. EPSS estimates a 0.21% chance of exploitation in the next 30 days, higher than 10.9% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
33/100
0100
Medium · default modelHow is this calculated?
CVSS score
5.8/10
010
Medium · v3.1 (CVE.org)
EPSS score
0.21%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github

Advisory lineage

Upstream 0 · Downstream 0 · Related 1
CGA-2JQC-MMFW-P34X

Timeline

  1. 22-06-2026
    PublishedVulnerability first disclosed.
  2. 23-06-2026
    Last modifiedVulnerability information updated.

Description

phpseclib is a PHP secure communications library. From 0.1.1 until 1.0.30, 2.0.55, and 3.0.54, when an application validates an untrusted X.509 certificate with phpseclib, X509::validateSignature() reads a URL out of that certificate's Authority Information Access (AIA) extension and connects to it. Attacker who supplies certificate fully controls host, port, and path of that connection. URL fetching is enabled by default, and no destination is blocked. An unauthenticated attacker can therefore make a validating server open connections to internal hosts and ports it should never reach, for example loopback 127.0.0.1, cloud metadata address 169.254.169.254, and internal-only services. This is a server-side request forgery (SSRF) caused by an insecure default. This vulnerability is fixed in 1.0.30, 2.0.55, and 3.0.54.

CVSS metrics

6 scores · 6 sources · 1 version

EPSS trend

Probability

0.21%

Chance of exploitation in the next 30 days

Percentile

11%

Versus all other CVEs

30-day change

0.00 pp

From 0.21% on 21-09-2026

21-09-202621-10-2026
EPSS score
0.21%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found
  • githubUnverified

    Phpseclib

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Chainguard3 products
  • nextcloud-server-31All versions (No fix recorded)
  • nextcloud-server-32< 32.0.11-r2
  • nextcloud-server-33< 33.0.5-r3
Debian3 products
  • php-phpseclibAll versions (No fix recorded) | < 2.0.55-1
  • php-phpseclib3All versions (No fix recorded) | < 3.0.55-1
  • phpseclibAll versions (No fix recorded)
Wolfi2 products
  • nextcloud-server-32< 32.0.11-r2
  • nextcloud-server-33< 33.0.5-r3
Phpseclib1 product
  • phpseclib≥ 0.1.1, < 1.0.30 | ≥ 2.0.0, < 2.0.55 | ≥ 3.0.0, < 3.0.54
Ubuntu1 product
  • phpseclibAll versions (No fix recorded)

5 vendors · 10 products

References

6 links