Package
nextcloud-server-32
Component
phpseclib/phpseclib
Latest update
6.3
CVSS V3
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Impact
nextcloud-server vendors phpseclib through Nextcloud's bundled 3rdparty dependency set, which requires phpseclib ^2.0. CVE-2026-84308 affects all phpseclib 2.x releases and is first fixed in 3.0.57; the 2.x line is closed at 2.0.55 with no backport available. Upgrading to 3.0.57 is not API-compatible — phpseclib changed its root namespace from phpseclib\ to phpseclib3\ at 3.0 — and Nextcloud's current stable branches still require ^2.0. The package already ships 2.0.55, the newest available 2.x release. This will be remediated once Nextcloud ships a release line depending on phpseclib 3.x.