What’s Vulnerable › Vulnerabilities

CVE-2026-74872: openssl_encrypt before 1.4.0 Arbitrary Code Execution via Whirlpool

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-17 · updated 2026-10-08
• Weakness: CWE-426

Description

openssl_encrypt versions before 1.4.0 contain an arbitrary code execution vulnerability in the Whirlpool hash implementation that uses broad glob patterns to load .so modules without integrity verification. Attackers can place malicious .so files matching the whirlpool*py313*.so pattern in site-packages directories to achieve native code execution when the module is loaded.

Affected products

• jahlives openssl_encrypt: before 1.4.0 — fixed in 1.4.0

How to fix

Upgrade to a fixed version: jahlives openssl_encrypt 1.4.0. Check the vendor advisory for mitigations.

References

• https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-j48q-4c78-rhf9
• https://www.vulncheck.com/advisories/openssl-encrypt-before-arbitrary-code-execution-via-whirlpool

Get alerted when CVE-2026-74872 or the next vulnerability affects your stack