CVE-2026-74889: jahlives openssl_encrypt

CVSS 9.8 (critical) · published 2026-08-17

openssl_encrypt versions before 1.4.0 use HKDF with no salt and static info parameter in key normalization functions, reducing entropy extraction and determinism. Attackers can exploit predictable key derivation with identical inputs to weaken cryptographic security against multi-target attacks.

Affected products (NVD): jahlives openssl_encrypt

Fixed in (NVD): 1.4.0

Weakness: CWE-326

Source: NVD CVE-2026-74889

References

• https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-j9mh-57cc-665x
• https://www.vulncheck.com/advisories/openssl-encrypt-before-weak-key-derivation-via-hkdf

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.