{"metadata": {"vulnerability": "cve-2023-49316", "count": 20, "kinds": {"milestone": 6, "sighting": 2, "kev": 0, "other": 12}}, "data": [{"timestamp": "2023-11-26T00:00:00Z", "date_only": false, "value": "2023-11-26T00:00:00.000Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "cve-2023-49316", "field": "cveMetadata.dateReserved"}, {"timestamp": "2023-11-27T00:00:00Z", "date_only": false, "value": "2023-11-27T00:00:00.000Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2023-49316", "field": "cveMetadata.datePublished"}, {"timestamp": "2023-11-27T18:15:00Z", "date_only": false, "value": "2023-11-27T18:15:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2023-49316", "record": "UBUNTU-CVE-2023-49316", "field": "published"}, {"timestamp": "2023-11-27T18:15:00Z", "date_only": false, "value": "2023-11-27T18:15Z", "kind": "other", "label": "Published Date", "source": "gsd \u00b7 GSD-2023-49316", "record": "GSD-2023-49316", "field": "namespaces.nvd.nist.gov.publishedDate"}, {"timestamp": "2023-11-27T18:15:07Z", "date_only": false, "value": "2023-11-27T18:15:07Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-JPR7-Q523-HX25", "record": "GHSA-JPR7-Q523-HX25", "field": "database_specific.nvd_published_at"}, {"timestamp": "2023-11-27T18:15:07.537Z", "date_only": false, "value": "2023-11-27T18:15:07.537", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2023-49316", "record": "FKIE_CVE-2023-49316", "field": "published"}, {"timestamp": "2023-11-27T18:31:14Z", "date_only": false, "value": "2023-11-27T18:31:14Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-JPR7-Q523-HX25", "record": "GHSA-JPR7-Q523-HX25", "field": "published"}, {"timestamp": "2023-11-30T03:15:13.625Z", "date_only": false, "value": "2023-11-30T03:15:13.625Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / mitre", "record": "cve-2023-49316", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2023-12-01T20:54:00Z", "date_only": false, "value": "2023-12-01T20:54Z", "kind": "other", "label": "Last Modified Date", "source": "gsd \u00b7 GSD-2023-49316", "record": "GSD-2023-49316", "field": "namespaces.nvd.nist.gov.lastModifiedDate"}, {"timestamp": "2023-12-13T01:20:34.993Z", "date_only": false, "value": "2023-12-13T01:20:34.993327Z", "kind": "other", "label": "Updated", "source": "gsd \u00b7 GSD-2023-49316", "record": "GSD-2023-49316", "field": "gsd.osvSchema.modified"}, {"timestamp": "2023-12-17T09:37:25Z", "date_only": false, "value": "2023-12-17T09:37:25.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/ctinow/155554", "record": "CVE-2023-49316", "field": "creation_timestamp", "uuid": "661c28c6-ea60-4c61-b28d-28f9505fa427", "content": "https://ift.tt/napWIgi\nCVE-2023-49316 | phpseclib up to 3.0.33 Math/BinaryField.php denial of service", "url": "https://t.me/ctinow/155554"}, {"timestamp": "2024-08-02T21:53:45.335Z", "date_only": false, "value": "2024-08-02T21:53:45.335Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "cve-2023-49316", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2024-08-02T21:53:45.335Z", "date_only": false, "value": "2024-08-02T21:53:45.335Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CVE", "record": "cve-2023-49316", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2025-10-24T05:02:21Z", "date_only": false, "value": "2025-10-24T05:02:21Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2023-49316", "record": "UBUNTU-CVE-2023-49316", "field": "modified"}, {"timestamp": "2026-05-08T23:06:38Z", "date_only": false, "value": "2026-05-08T23:06:38Z", "kind": "other", "label": "Withdrawn", "source": "github \u00b7 GHSA-JPR7-Q523-HX25", "record": "GHSA-JPR7-Q523-HX25", "field": "withdrawn"}, {"timestamp": "2026-05-08T23:06:39Z", "date_only": false, "value": "2026-05-08T23:06:39Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-JPR7-Q523-HX25", "record": "GHSA-JPR7-Q523-HX25", "field": "modified"}, {"timestamp": "2026-05-08T23:06:50Z", "date_only": false, "value": "2026-05-08T23:06:50Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-2F25-PFQ3-C7H8", "record": "GHSA-2F25-PFQ3-C7H8", "field": "published"}, {"timestamp": "2026-05-08T23:06:50Z", "date_only": false, "value": "2026-05-08T23:06:50Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-2F25-PFQ3-C7H8", "record": "GHSA-2F25-PFQ3-C7H8", "field": "modified"}, {"timestamp": "2026-05-09T06:10:29Z", "date_only": false, "value": "2026-05-09T06:10:29.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/5630cef7c3595002259238662d69e7b6", "record": "CVE-2023-49316", "field": "creation_timestamp", "uuid": "f13b934f-ed39-4137-9ee6-ec53ac916eff", "content": "# CVE-2023-49316: CVE-2023-49316: Denial of Service via Unbounded Degree in phpseclib Binary Finite Fields\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-05-08\n> **Full Report:** https://cvereports.com/reports/CVE-2023-49316\n\n## Summary\nThe phpseclib cryptographic library version 3.x prior to 3.0.34 contains a Denial of Service (DoS) vulnerability in its mathematical field generation logic. When parsing maliciously crafted X.509 certificates or PKCS#8 private keys specifying Elliptic Curve parameters over a binary finite field, the library fails to validate the degree parameter. This flaw allows a remote attacker to force the PHP application to perform unbounded memory allocations, exhausting server resources and terminating the application worker process.\n\n## TL;DR\nphpseclib 3.x before 3.0.34 fails to bound the degree parameter when parsing Elliptic Curve keys over binary fields, allowing unauthenticated attackers to cause a fatal Out-Of-Memory (OOM) crash via a crafted ASN.1 payload.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-834\n- **Attack Vector**: Network\n- **CVSS v3.1**: 7.5\n- **EPSS Score**: 0.15%\n- **Impact**: High (Availability)\n- **Exploit Status**: Proof-of-Concept\n- **CISA KEV**: Not Listed\n\n## Affected Systems\n\n- phpseclib 3.0.x\n- **phpseclib**: >= 3.0.0, < 3.0.34 (Fixed in: `3.0.34`)\n\n## Mitigation\n\n- Upgrade phpseclib to version 3.0.34 or later.\n- Implement application-level exception handling for OutOfBoundsException during cryptographic material parsing.\n- Enforce strict file size limits on endpoints accepting user-uploaded certificate files.\n\n**Remediation Steps:**\n1. Identify the project dependencies using composer: `composer show phpseclib/phpseclib`.\n2. Update the composer requirement to pull the latest 3.0.x patch: `composer require phpseclib/phpseclib:^3.0.34`.\n3. Execute `composer update`.\n4. Deploy the updated `composer.lock` file to production environments.\n5. Audit all calls to `EC::loadFormat()` to ensure proper `try...catch` blocks encompass the parsing logic.\n\n## References\n\n- [GitHub Security Advisory: GHSA-2f25-pfq3-c7h8](https://github.com/advisories/GHSA-2f25-pfq3-c7h8)\n- [Fix Commit in phpseclib](https://github.com/phpseclib/phpseclib/commit/964d78101a70305df33f442f5490f0adb3b7e77f)\n- [USENIX Paper: X.509DoS](https://www.usenix.org/system/files/usenixsecurity25-shi-bing.pdf)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2023-49316) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/5630cef7c3595002259238662d69e7b6"}, {"timestamp": "2026-06-17T06:35:48.733Z", "date_only": false, "value": "2026-06-17T06:35:48.733", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2023-49316", "record": "FKIE_CVE-2023-49316", "field": "lastModified"}]}