by Kastro
Paper/Archive/CVE-2026-74875

CVE-2026-74875

jahlives openssl_encrypt — openssl_encrypt before 1.4.0 Schema Validation Bypass

EPSS 0.3%CVSS 9.8
critical.is priorityof 100
33
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 19.7.197 × 203.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

openssl_encrypt versions before 1.4.0 silently skip JSON schema validation when the jsonschema library is not installed, allowing malformed metadata to be accepted. Attackers can remove the jsonschema package or supply unknown metadata format versions to bypass all schema checks and process malicious data.

Affected

ProductAffectedFixed inSource
openssl_encrypt< 1.4.01.4.0CNA

Scores by source

VulnCheck (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

advisorygithub.com/jahlives/openssl_encrypt/security/advisories/GHSA-425g-fjhq-5h92writeupvulncheck.com/advisories/openssl-encrypt-before-schema-validation-bypass