{"action":"Upgrade php-phpseclib to 2.0.42-1+deb12u4 or later.","affected":[{"fixed":"2.0.42-1+deb12u4","introduced":"0"}],"component":"php-phpseclib","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:12","exploited":false,"fixed_versions":["2.0.42-1+deb12u4"],"id":"tcs_01M5NRXAJNHACF76DE37ACEBY2","modified_at":"2026-10-01T03:03:13.234100060Z","published_at":"2026-04-10T21:16:27.583Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2026-40194","https://security-tracker.debian.org/tracker/CVE-2026-40194"],"severity":{"label":"low","score":3.7},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2026-40194","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2026-40194"}],"summary":"phpseclib is a PHP secure communications library. Starting in 0.1.1 and prior to 3.0.51, 2.0.53, and 1.0.28, phpseclib\\Net\\SSH2::get_binary_packet() uses PHP's != operator to compare a received SSH pa"}