Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.3
CVE-2026-74887: OpenSSL 1.3.x: Insecure Random Number Import
CVE-2026-74887 · published 1 month ago
Summary
OpenSSL's encryption module before version 1.4.0 uses a non-secure random number generator. This could potentially lead to predictable numbers being generated in the future if the wrong random number function is used. To fix this, update to OpenSSL version 1.4.0 or later.
What to do
- Update jahlives openssl_encrypt to version 1.4.0 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| jahlives | openssl_encrypt | < 1.4.0 |
Original advisory text
openssl_encrypt before 1.4.0 Insecure Random Import in PQC Module
openssl_encrypt before 1.4.0 imports Python's non-cryptographic 'random' module (Mersenne Twister PRNG) at line 15 of openssl_encrypt/modules/pqc.py. No direct calls to random.* were present in the code, so no cryptographic operation is currently affected; however, the import creates a hazard that future code could inadvertently use random.randint() instead of a cryptographically secure alternative (secrets/os.urandom), producing predictable values since the Mersenne Twister state can be recovered from approximately 624 outputs. Fixed by removing the import in 1.4.0.
References
- https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-cx72-m6xj-3... Mitigation Vendor Advisory
- https://www.vulncheck.com/advisories/openssl-encrypt-before-insecure-random-impo... Third Party Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74887... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-74887 Vendor Advisory
Severity
6.3
Medium
CVSS 3.1: 0.0 (NVD)
CVSS 4.0: 9.3 (NVD)
Exploitation
EPSS <1%
Type
CWE-338Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Timeline
Published17 Aug 2026
Updated27 Sep 2026
First seen17 Aug 2026
Track software like this
Free during beta