{"action":"Upgrade phpseclib/phpseclib to 1.0.28 or later.","affected":[{"fixed":"1.0.28","introduced":"0.1.1"},{"fixed":"2.0.53","introduced":"2.0.0"},{"fixed":"3.0.51","introduced":"3.0.0"}],"component":"phpseclib/phpseclib","cve_ids":["CVE-2026-40194"],"ecosystem":"Packagist","epss":0.00368,"exploited":false,"fixed_versions":["1.0.28","2.0.53","3.0.51"],"ghsa_id":"GHSA-r854-jrxh-36qx","id":"tcs_01M5KF823R5GKV40TXP11JTK42","modified_at":"2026-09-10T03:51:02.985672750Z","published_at":"2026-04-10T20:58:10Z","references":["https://osv.dev/vulnerability/GHSA-r854-jrxh-36qx","https://github.com/phpseclib/phpseclib/security/advisories/GHSA-r854-jrxh-36qx","https://nvd.nist.gov/vuln/detail/CVE-2026-40194","https://github.com/phpseclib/phpseclib/commit/ffe48b6b1b1af6963327f0a5330e3aa004a194ac","https://github.com/phpseclib/phpseclib","https://github.com/phpseclib/phpseclib/releases/tag/1.0.28","https://github.com/phpseclib/phpseclib/releases/tag/2.0.53","https://github.com/phpseclib/phpseclib/releases/tag/3.0.51"],"severity":{"label":"low","score":3.7},"sources":[{"source":"osv","source_id":"GHSA-r854-jrxh-36qx","url":"https://osv.dev/vulnerability/GHSA-r854-jrxh-36qx"}],"summary":"phpseclib has a variable-time HMAC comparison in SSH2::get_binary_packet() using != instead of hash_equals()"}