What’s Vulnerable › Vulnerabilities

CVE-2026-74888: openssl_encrypt before 1.4.0 Non-Standard PBKDF2 Key Derivation

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-17 · updated 2026-09-01
• Weakness: CWE-327

Description

openssl_encrypt versions before 1.4.0 use a non-standard PBKDF2 key derivation construction with iterations=1 per call in an outer loop, creating a KDF whose security properties have not been formally analyzed. Attackers can exploit this weakened key derivation to more efficiently crack passwords protecting legacy encrypted files compared to standard PBKDF2 implementations.

Affected products

• jahlives openssl_encrypt: before 1.4.0 — fixed in 1.4.0

How to fix

Upgrade to a fixed version: jahlives openssl_encrypt 1.4.0. Check the vendor advisory for mitigations.

References

• https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-743f-89fg-x288
• https://www.vulncheck.com/advisories/openssl-encrypt-before-non-standard-pbkdf2-key-derivation

Get alerted when CVE-2026-74888 or the next vulnerability affects your stack