CVE-2023-52892
Phpseclib 1.0.0 – 1.0.22
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2023-52892 is a high-severity Interpretation Conflict (CWE-436) vulnerability in Phpseclib Phpseclib. Its CVSS base score is 7.5 (High).
Operationally, ranked at the 30th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-2038
Vulnerability Data
In phpseclib before 1.0.22, 2.x before 2.0.46, and 3.x before 3.0.33, some characters in Subject Alternative Name fields in TLS certificates are incorrectly allowed to have a special meaning in regular expressions (such as a + wildcard), leading to name…
more
confusion in X.509 certificate host verification.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation can discover cases where two products interpret the same inputs or state transitions differently.
Strict, consistently applied input validation reduces the chance that one product will accept data the other product rejects or interprets differently.
Applying security engineering principles during design can require unambiguous protocol and data-format specifications that eliminate divergent interpretations between products.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
A.8.25 mandates a secure SDLC process with checkpoints, secure coding, testing and training; it does not stop differing interpretations of shared state or inputs between two products from arising or being exploited
A.8.26 only requires that security requirements (including resilience against injections or input controls) be identified and specified during development or acquisition; it does not itself enforce, implement or assure any mechanism that stops an interpretation conflict from being exploitable.
A.8.27 establishes and applies secure-by-design principles (defense-in-depth, least privilege, assume-breach, distrust-external-input, hardening, etc.) but does not stop two products from interpreting the same input or protocol step differently; the resulting state/conflict weakness can still be present and exploitable.
Secure coding standards can enforce canonical input handling and strict protocol compliance to avoid misinterpretation between products.
Security testing can detect and correct cases where one component misinterprets another’s state or messages.
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.
- No fine-grained STIG row for CWE-436, a class-level weakness, and none of its children carries one either.