CVE-2023-52892

HIGH

In phpseclib before 1.0.22, 2.x before 2.0.46, and 3.x before 3.0.33, some characters in Subject Alternative Name fields in TLS certificates are incorrectly allowed to have a special meaning in reg...

Affects 1 product across 1 vendor.

CVSS 3.17.5
EPSS0.4%
Percentile30th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, no integrity impact, no availability impact.
CWE Weakness Definitions
CWE-436: CWE-436
Related Attack Patterns (CAPEC)
CAPEC-34 HTTP Response Splitting
via CWE-436
CAPEC-105 HTTP Request Splitting
via CWE-436
CAPEC-273 HTTP Response Smuggling
via CWE-436

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

A vulnerability in phpseclib versions before 1.0.22, 2.x before 2.0.46, and 3.x before 3.0.33 allows for incorrect interpretation of special characters in Subject Alternative Name fields of TLS certificates, potentially leading to host verification bypass.

BSID: BS-2024-GLOBAL-175885-H • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: MEDIUM

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2023-52892?
A vulnerability in phpseclib versions before 1.0.22, 2.x before 2.0.46, and 3.x before 3.0.33 allows for incorrect interpretation of special characters in Subject Alternative Name fields of TLS certificates, potentially leading to host verification bypass.
What is the CVSS score for CVE-2023-52892?
CVE-2023-52892 has CVSS 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS: 0.4%.
Is CVE-2023-52892 actively exploited?
No confirmed active exploitation of CVE-2023-52892 as of 2026-09-25.
How do I remediate CVE-2023-52892?
Priority: HIGH.
What systems are affected by CVE-2023-52892?
CVE-2023-52892 affects Phpseclib Phpseclib.
Vulnerability Details
CVE IDCVE-2023-52892
BSIDBS-2024-GLOBAL-175885-H BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Published2024-06-27
Last Modified2026-06-17
ICS Relevance0%
Weakness (CWE)
CWE-436
SourceNVD
Official Description

In phpseclib before 1.0.22, 2.x before 2.0.46, and 3.x before 3.0.33, some characters in Subject Alternative Name fields in TLS certificates are incorrectly allowed to have a special meaning in regular expressions (such as a + wildcard), leading to name confusion in X.509 certificate host verification.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

An attacker could exploit this vulnerability by crafting a malicious TLS certificate with a Subject Alternative Name field that includes special characters interpreted as wildcards or other regex operators. This could lead to the verification of the certificate being incorrectly accepted by systems using vulnerable versions of phpseclib.

Exploitation Likelihood: MEDIUM

Affected Products
VendorProductAffected Versions
Phpseclib Phpseclib < 1.0.22
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 840 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceMEDIUM
Enriched At2026-05-24
SHA-512 Audit Hash6209739b4b2e50caf0d8b0823ac504003d25c2ad609382ee4f2b0844a36c9de78114d8c567be941154294ca0ae3164c1d1b2e91aa08c50ee82cf4f22e86fd350
Related CVEs affecting Phpseclib
CVE-2026-1357 9.8 The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPr... CVE-2023-27560 7.5 Math/PrimeField.php in phpseclib 3.x before 3.0.19 has an infinite loop with ... CVE-2023-49316 7.5 In Math/BinaryField.php in phpseclib 3 before 3.0.34, excessively large degre... CVE-2024-27354 7.5 An issue was discovered in phpseclib 1.x before 1.0.23, 2.x before 2.0.47, an... CVE-2024-27355 7.5 An issue was discovered in phpseclib 1.x before 1.0.23, 2.x before 2.0.47, an...
View all Phpseclib CVEs →

ICS/OT Vulnerability Intelligence for Your Environment

BreachSpider tracks 384,000+ CVEs and matches them to your ICS/OT assets by exact version, with AI analysis, NERC CIP mapping, and vendor PSIRT contacts.

Create a free account →