CVE-2024-27354: Computational Denial of Service via Unbounded Primality Testing in phpseclib

Vulnerability ID: CVE-2024-27354

CVSS Score: 7.5

Published: 2026-05-06

A computational Denial of Service (DoS) vulnerability in phpseclib allows unauthenticated attackers to exhaust CPU resources by supplying malformed X.509 certificates. The vulnerability arises from missing bit-length upper bounds in the Miller-Rabin primality test implementation when evaluating explicit elliptic curve field parameters.

TL;DR

phpseclib before versions 1.0.23, 2.0.47, and 3.0.36 suffers from a computational DoS flaw where parsing maliciously crafted X.509 certificates with massive explicit primes triggers an unbounded Miller-Rabin primality test, leading to CPU exhaustion.

⚠️ Exploit Status: POC

Technical Details

CWE ID : CWE-400

Attack Vector : Network

CVSS v3.1 Score : 7.5 (High)

EPSS Score : 0.00204 (42.24%)

Impact : Denial of Service (CPU Exhaustion)

Exploit Status : Proof of Concept

CISA KEV : No

Affected…