CVE-2026-74888CWE-327

CVE-2026-74888

High · published August 17, 2026

CVSS v3.1

7.5

EPSS

Percentile

18.5

In the wild

Unconfirmed

What it is

openssl_encrypt versions before 1.4.0 use a non-standard PBKDF2 key derivation construction with iterations=1 per call in an outer loop, creating a KDF whose security properties have not been formally analyzed. Attackers can exploit this weakened key derivation to more efficiently crack passwords protecting legacy encrypted files compared to standard PBKDF2 implementations.

The record

Technical detail

CVSS v3.1: 7.5 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0: 8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS: 0.00272 · 18.5th percentile
Weakness: CWE-327 · Use of a Broken or Risky Cryptographic Algorithm
Published: 2026-08-17T15:16Z

Affected products (1)

Product	Versions	Fixed in
jahlives/openssl_encrypt	< 1.4.0	1.4.0

References (2)

https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-743f-89fg-x288 · [email protected]https://www.vulncheck.com/advisories/openssl-encrypt-before-non-standard-pbkdf2-key-derivation · [email protected]

EPSS history

Timeline

17 AUG 11:04Z
openssl_encrypt before 1.4.0 Non-Standard PBKDF2 Key Derivation
cvelistv5