phpseclib: guardrails needed on isPrime and randomPrime
Date: 2026-05
Affected: composer/phpseclib/phpseclib, composer/phpseclib/phpseclib, composer/phpseclib/phpseclib
Attack vector: dos
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2024-27354
CVE-2024-27355
CWE: CWE-400
CVSS: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

### Impact Anyone trying to generate a prime and testing the primality of a number. ### Patches https://github.com/phpseclib/phpseclib/commit/ad5dbdf2129f5e0fb644637770b7f33de8ca8575 ### Workarounds Using the GMP extension would probably help, assuming that one has its own guardrails. ### Resources https://github.com/phpseclib/phpseclib/commit/ad5dbdf2129f5e0fb644637770b7f33de8ca8575 https://www.usenix.org/system/files/conference/usenixsecurity25/sec25cycle1-prepub-599-shi-bing.pdf


Mitigations:

Architectural layers (MAESTRO):