CVE-2026-74875CWE-345

CVE-2026-74875

Critical · published August 17, 2026

CVSS v3.1
9.8
EPSS
0%
Percentile
18.7
In the wild
Unconfirmed
What it is

openssl_encrypt versions before 1.4.0 silently skip JSON schema validation when the jsonschema library is not installed, allowing malformed metadata to be accepted. Attackers can remove the jsonschema package or supply unknown metadata format versions to bypass all schema checks and process malicious data.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00274 · 18.7th percentile
Weakness
CWE-345 · Insufficient Verification of Data Authenticity
Published
2026-08-17T15:16Z
Affected products (1)
ProductVersionsFixed in
jahlives/openssl_encrypt< 1.4.01.4.0
References (2)
https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-425g-fjhq-5h92 · [email protected]https://www.vulncheck.com/advisories/openssl-encrypt-before-schema-validation-bypass · [email protected]
EPSS history
Timeline
  • 17 AUG 11:04Z
    openssl_encrypt before 1.4.0 Schema Validation Bypass
    cvelistv5