CVE-2026-74875: jahlives openssl_encrypt

CVSS 9.8 (critical) · published 2026-08-17

openssl_encrypt versions before 1.4.0 silently skip JSON schema validation when the jsonschema library is not installed, allowing malformed metadata to be accepted. Attackers can remove the jsonschema package or supply unknown metadata format versions to bypass all schema checks and process malicious data.

Affected products (NVD): jahlives openssl_encrypt

Fixed in (NVD): 1.4.0

Weakness: CWE-345

Source: NVD CVE-2026-74875

References

• https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-425g-fjhq-5h92
• https://www.vulncheck.com/advisories/openssl-encrypt-before-schema-validation-bypass

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.