Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.3
CVE-2026-74876: OpenSSL: Unverified Encryption Keys Can Leak Secrets
CVE-2026-74876 · published 1 month ago
Summary
A recent OpenSSL update fixes a security issue where encryption keys are not properly verified before use. This could allow an attacker to steal sensitive information. To fix this, the update requires developers to verify the keys before using them for encryption.
What to do
- Update tobi openssl-encrypt to version 1.4.0.
- Update jahlives openssl_encrypt to version 1.4.0 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| pip | tobi | openssl-encrypt |
< 1.4.0 Fix: upgrade to 1.4.0
|
| – | jahlives | openssl_encrypt | < 1.4.0 |
Original advisory text
openssl_encrypt before 1.4.0 Unverified Key Bundle Encryption
openssl_encrypt versions before 1.4.0 contain a vulnerability in PublicKeyBundle.from_dict() that creates key bundles from untrusted data without verifying signatures. Attackers can call from_dict() followed by to_identity() without signature verification to encrypt data using attacker-controlled public keys, leaking secrets.
References
- https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-8h88-gxp3-j... Mitigation Vendor Advisory
- https://github.com/jahlives/openssl_encrypt/commit/f4a1ba660063cd9e17883829e5272...
- https://github.com/advisories/GHSA-8h88-gxp3-j7pg
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74876... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-74876 Vendor Advisory
- https://www.vulncheck.com/advisories/openssl-encrypt-before-unverified-key-bundl... Third Party Advisory
Severity
9.3
Critical
CVSS 4.0: 6.6 (GHSA)
CVSS 4.0: 9.3 (NVD)
CVSS 3.1: 9.8 (NVD)
Exploitation
EPSS <1%
Type
CWE-347Improper Verification of Cryptographic Signature
Timeline
Published17 Aug 2026
Updated27 Sep 2026
First seen1 Apr 2026
Track software like this
Free during beta