The vulnerability allows an attacker to force phpseclib to process an improperly constructed ASN1 OID, causing memory exhaustion and a denial of service. It bypasses the mitigation added for CVE‑2024‑27355, and is classified as CWE‑400. Attackers can trigger the crash by supplying a crafted ASN1 file such as an X509 certificate or RSA key.

Affected versions are all releases of phpseclib prior to 1.0.29, 2.0.54, and 3.0.52. If your application uses these older libraries, it is vulnerable. The vulnerability applies to the phpseclib::ASN1::decodeOID function across PHP codebases that import certificates or keys.

The CVSS score of 7.5 indicates a high risk. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, suggesting no widespread active exploitation yet. However, the flaw is exploitable over the network when an application trusts untrusted ASN1 data, so the likely attack vector is remote. Administrators should treat this as a high‑severity DoS risk until the library is updated.