CVE-2024-27354: Phpseclib DOS Vulnerability

CVE-2024-27354 Overview

CVE-2024-27354 is a denial-of-service vulnerability in phpseclib, a pure-PHP implementation of cryptographic protocols used by countless PHP applications. An attacker can craft a malformed X.509 certificate that embeds an extremely large prime value. When the library parses the certificate, it invokes an isPrime primality check against that value, causing sustained CPU exhaustion on the host. The flaw affects phpseclib 1.x before 1.0.23, 2.x before 2.0.47, and 3.x before 3.0.36. The issue was inadvertently introduced while patching CVE-2023-27560.

Critical Impact
A remote, unauthenticated attacker can trigger high CPU consumption by submitting a single malformed certificate, degrading or halting availability of any PHP service that parses untrusted certificates.

Affected Products

phpseclib 1.x prior to 1.0.23
phpseclib 2.x prior to 2.0.47 and 3.x prior to 3.0.36
Debian GNU/Linux 10 (Buster) packages bundling vulnerable phpseclib versions

Discovery Timeline

2024-03-01 - CVE-2024-27354 published to the National Vulnerability Database
2024-03-02 - Debian LTS Advisory published
2024-03-03 - Follow-up Debian LTS Advisory published
2025-09-15 - Last updated in NVD database

Technical Details for CVE-2024-27354

Vulnerability Analysis

The vulnerability resides in phpseclib's X.509 certificate parsing path. When the library decodes a certificate's elliptic-curve or finite-field parameters, it passes the embedded prime to a primality verification routine. The implementation does not enforce a maximum bit length on the supplied prime. Attackers can therefore submit a prime value that is orders of magnitude larger than any legitimate cryptographic parameter. The resulting primality test loops through expensive arbitrary-precision arithmetic, consuming CPU cycles indefinitely from the perspective of the calling application. The flaw is classified under CWE-400: Uncontrolled Resource Consumption.

Root Cause

The regression was introduced when developers patched CVE-2023-27560. The fix added an isPrime check inside phpseclib/Math/PrimeField.php to validate prime parameters but omitted a length or sanity guard on the input. As documented in the PrimeField source on GitHub, the primality routine operates on attacker-controlled BigInteger objects without bounds enforcement.

Attack Vector

Exploitation requires no authentication and no user interaction. An attacker submits a crafted certificate through any application endpoint that hands certificates to phpseclib for parsing, such as TLS handshakes, SAML assertions, JWT validation flows, or S/MIME processing. The single malformed certificate is sufficient to pin a PHP worker process at 100% CPU. Repeated submissions exhaust the worker pool and produce a full denial of service. A proof of concept is published as a GitHub Gist by katzj.

Detection Methods for CVE-2024-27354

Indicators of Compromise

PHP-FPM or Apache worker processes sustained at 100% CPU after receiving certificate input
Inbound requests carrying X.509 certificates with prime fields exceeding several thousand bits
Repeated TLS or SAML requests from a single source correlating with worker pool exhaustion
Application timeouts and 502/504 responses concentrated on endpoints that parse certificates

Detection Strategies

Inventory PHP applications and identify those bundling phpseclib versions below 1.0.23, 2.0.47, or 3.0.36 via Composer lock files
Enable PHP max_execution_time and log scripts that exceed the limit inside certificate parsing routines
Inspect web server logs for unusually large request bodies on endpoints that accept certificates or signed tokens

Monitoring Recommendations

Alert on sustained CPU utilization above a defined threshold for PHP worker processes
Track outliers in request processing latency for any route that calls into phpseclib
Correlate source IPs that submit malformed certificate payloads across multiple application tiers

How to Mitigate CVE-2024-27354

Immediate Actions Required

Upgrade phpseclib to 1.0.23, 2.0.47, or 3.0.36 or later via Composer
Apply Debian LTS package updates on Debian 10 systems using vulnerable distribution packages
Restart PHP-FPM, Apache, or worker daemons so updated library code is loaded
Audit dependent libraries that vendor phpseclib internally and update them in lockstep

Patch Information

The phpseclib maintainers shipped fixes in versions 1.0.23, 2.0.47, and 3.0.36 that bound the size of primes accepted by the isPrime check inside phpseclib/Math/PrimeField.php. Debian distributed equivalent backports through the March 2 LTS advisory and the March 3 LTS advisory.

Workarounds

Place a reverse proxy or WAF in front of vulnerable applications and reject certificate payloads larger than a known-good ceiling
Lower PHP max_execution_time on endpoints that parse certificates to abort runaway primality checks
Restrict certificate-accepting endpoints to authenticated callers until patching completes

bash

# Update phpseclib via Composer to a fixed release
composer require phpseclib/phpseclib:^3.0.36

# Or upgrade the 2.x branch
composer require phpseclib/phpseclib:^2.0.47

# Debian 10 LTS package update
sudo apt-get update
sudo apt-get install --only-upgrade php-phpseclib

# Verify installed version
php -r "echo \\phpseclib3\\Common\\Functions\\Strings::class;"
composer show phpseclib/phpseclib | grep versions