CVE-2026-74879CWE-209

CVE-2026-74879

High · published August 17, 2026

CVSS v3.1

7.5

EPSS

Percentile

37.6

In the wild

Unconfirmed

What it is

openssl_encrypt versions before 1.4.0 contain an information disclosure vulnerability in the /ready endpoint that returns full database exception strings to unauthenticated callers. Attackers can trigger database errors to extract sensitive information including hostnames, IP addresses, connection parameters, and potentially credentials from exception messages.

The record

Technical detail

CVSS v3.1: 7.5 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0: 8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS: 0.00444 · 37.6th percentile
Weakness: CWE-209 · Generation of Error Message Containing Sensitive Information
Published: 2026-08-17T15:16Z

Affected products (1)

Product	Versions	Fixed in
jahlives/openssl_encrypt	< 1.4.0	1.4.0

References (2)

https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-2vhw-q7vh-7xv2 · [email protected]https://www.vulncheck.com/advisories/openssl-encrypt-before-information-disclosure-via-ready-endpoint · [email protected]

EPSS history

Timeline

17 AUG 11:04Z
openssl_encrypt before 1.4.0 Information Disclosure via /ready endpoint
cvelistv5