CVE-2026-55599

Name of the Vulnerable Software and Affected Versions phpseclib versions 0.1.1 through 1.0.29 phpseclib versions 2.0.0 through 2.0.54 phpseclib versions 3.0.0 through 3.0.53

Description An insecure default in the library allows an unauthenticated attacker to perform Server-Side Request Forgery (SSRF). When an application validates an untrusted X.509 certificate, the X509::validateSignature() function reads a URL from the certificate's Authority Information Access (AIA) extension and establishes a connection to it. Because URL fetching is enabled by default without destination blocking, an attacker can control the host, port, and path of the connection to reach internal hosts and services, such as the loopback address 127.0.0.1 or cloud metadata addresses like 169.254.169.254.

Recommendations Update to version 1.0.30. Update to version 2.0.55. Update to version 3.0.54.