CVE-2026-74889CWE-326

CVE-2026-74889

Critical · published August 17, 2026

CVSS v3.1
9.8
EPSS
0%
Percentile
27.2
In the wild
Unconfirmed
What it is

openssl_encrypt versions before 1.4.0 use HKDF with no salt and static info parameter in key normalization functions, reducing entropy extraction and determinism. Attackers can exploit predictable key derivation with identical inputs to weaken cryptographic security against multi-target attacks.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00348 · 27.2th percentile
Weakness
CWE-326 · Inadequate Encryption Strength
Published
2026-08-17T15:16Z
Affected products (1)
ProductVersionsFixed in
jahlives/openssl_encrypt< 1.4.01.4.0
References (2)
https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-j9mh-57cc-665x · [email protected]https://www.vulncheck.com/advisories/openssl-encrypt-before-weak-key-derivation-via-hkdf · [email protected]
EPSS history
Timeline
  • 17 AUG 11:04Z
    openssl_encrypt before 1.4.0 Weak Key Derivation via HKDF
    cvelistv5