CVE-2026-40194: phpseclib Information Disclosure Flaw

CVE-2026-40194 Overview

CVE-2026-40194 is a timing attack vulnerability (CWE-208) affecting phpseclib, a widely-used PHP secure communications library. The vulnerability exists in the phpseclib\Net\SSH2::get_binary_packet() function, which uses PHP's != operator to compare a received SSH packet HMAC against the locally computed HMAC. This non-constant-time comparison operation allows attackers to potentially extract HMAC values through timing side-channel analysis.

Critical Impact

Attackers positioned on the network may leverage timing analysis to gain partial information about HMAC values, potentially undermining the integrity verification of SSH communications.

Affected Products

• phpseclib versions prior to 3.0.51
• phpseclib versions prior to 2.0.53
• phpseclib versions prior to 1.0.28

Discovery Timeline

• 2026-04-10 - CVE CVE-2026-40194 published to NVD
• 2026-04-13 - Last updated in NVD database

Technical Details for CVE-2026-40194

Vulnerability Analysis

The vulnerability stems from the use of PHP's != comparison operator in the SSH2 packet handling code. When comparing equal-length binary strings, PHP's != operator internally uses memcmp(), which performs a byte-by-byte comparison that short-circuits on the first differing byte. This behavior creates a measurable timing difference based on how many leading bytes match between the received HMAC and the expected HMAC.

This timing side-channel attack (CWE-208) allows an attacker who can observe network timing to statistically deduce information about the correct HMAC value. While exploitation requires precise timing measurements and statistical analysis over many connection attempts, the vulnerability has been proven through scaling benchmarks to demonstrate real variable-time behavior.

Root Cause

The root cause is the use of a non-constant-time string comparison operation for cryptographic verification. The != operator in PHP does not provide constant-time guarantees when comparing strings, as the underlying memcmp() function returns immediately upon finding a differing byte. Cryptographic comparisons should always use constant-time algorithms that take the same amount of time regardless of how many bytes match.

Attack Vector

The attack vector is network-based. An attacker must be able to:

1. Intercept or observe SSH connections to systems using vulnerable phpseclib versions
2. Measure the precise timing of HMAC verification responses
3. Perform statistical analysis across many SSH packet exchanges to detect timing variations
4. Reconstruct partial or complete HMAC values through accumulated timing data

While the attack complexity is high and requires sophisticated timing analysis capabilities, it represents a real cryptographic weakness that violates security best practices for HMAC verification.

// Security patch in phpseclib/Net/SSH2.php - SSH2: use constant time string comparison in get_binary_packet()
                $this->bitmap = 0;
                user_error('Error reading socket');
                return false;
-            } elseif ($hmac != $this->hmac_check->hash(pack('NNCa*', $this->get_seq_no, $packet_length, $padding_length, $payload . $padding))) {
+            } elseif (!$this->_equals($hmac, $this->hmac_check->hash(pack('NNCa*', $this->get_seq_no, $packet_length, $padding_length, $payload . $padding)))) {
                user_error('Invalid HMAC');
                return false;
            }

Source: GitHub Commit Update

Detection Methods for CVE-2026-40194

Indicators of Compromise

• Unusual patterns of repeated SSH connection attempts from the same source with minimal data exchange
• High-frequency connection requests with precise timing characteristics indicative of timing analysis
• Network traffic patterns suggesting statistical probing of SSH endpoints

Detection Strategies

• Implement dependency scanning to identify phpseclib installations running vulnerable versions (prior to 3.0.51, 2.0.53, or 1.0.28)
• Deploy Software Composition Analysis (SCA) tools to audit PHP projects for vulnerable phpseclib dependencies
• Review application logs for anomalous SSH connection patterns that may indicate timing attack attempts

Monitoring Recommendations

• Monitor network traffic for unusual timing patterns in SSH packet exchanges
• Implement rate limiting on SSH connections to mitigate timing analysis attempts
• Use intrusion detection systems capable of identifying statistical probing behavior

How to Mitigate CVE-2026-40194

Immediate Actions Required

• Upgrade phpseclib to version 3.0.51, 2.0.53, or 1.0.28 depending on your version branch
• Review all applications that depend on phpseclib and update composer dependencies accordingly
• Audit your codebase for any custom implementations of HMAC verification that may have similar non-constant-time comparison issues

Patch Information

The phpseclib maintainers have released patched versions across all supported branches. The fix replaces the != operator with a constant-time comparison function (_equals()) that provides cryptographically secure string comparison:

• phpseclib 3.0.51 - For users on the 3.x branch
• phpseclib 2.0.53 - For users on the 2.x branch
• phpseclib 1.0.28 - For users on the legacy 1.x branch

For complete details, see the GitHub Security Advisory GHSA-r854-jrxh-36qx.

Workarounds

• If immediate patching is not possible, consider adding network-level protections such as rate limiting to reduce the effectiveness of timing analysis
• Implement additional network segmentation to limit attacker visibility into SSH connection timing
• Monitor for phpseclib updates and prioritize patching as soon as maintenance windows allow

# Update phpseclib using Composer
composer require phpseclib/phpseclib:^3.0.51

# For 2.x branch users
composer require phpseclib/phpseclib:^2.0.53

# For legacy 1.x branch users
composer require phpseclib/phpseclib:^1.0.28