{"action":"Upgrade phpseclib/phpseclib to 1.0.27 or later.","affected":[{"fixed":"3.0.50","introduced":"3.0.0"},{"fixed":"2.0.52","introduced":"2.0.0"},{"fixed":"1.0.27","introduced":"0.1.1"}],"component":"phpseclib/phpseclib","cve_ids":["CVE-2026-32935"],"ecosystem":"Packagist","epss":0.00389,"exploited":false,"fixed_versions":["3.0.50","2.0.52","1.0.27"],"ghsa_id":"GHSA-94g3-g5v7-q4jg","id":"tcs_01M5KEZM7APDZAFE7M14W49S8X","modified_at":"2026-09-10T03:50:38.415264842Z","published_at":"2026-03-19T16:42:18Z","references":["https://osv.dev/vulnerability/GHSA-94g3-g5v7-q4jg","https://github.com/phpseclib/phpseclib/security/advisories/GHSA-94g3-g5v7-q4jg","https://nvd.nist.gov/vuln/detail/CVE-2026-32935","https://github.com/phpseclib/phpseclib/commit/ccc21aef71eb170e9bf819b167e67d1fd9e6e788","https://github.com/phpseclib/phpseclib"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-94g3-g5v7-q4jg","url":"https://osv.dev/vulnerability/GHSA-94g3-g5v7-q4jg"}],"summary":"phpseclib's AES-CBC unpadding susceptible to padding oracle timing attack"}