High severity7.5OSV Advisory· Published Aug 17, 2026· Updated Sep 1, 2026
CVE-2026-74879
CVE-2026-74879
Description
openssl_encrypt versions before 1.4.0 contain an information disclosure vulnerability in the /ready endpoint that returns full database exception strings to unauthenticated callers. Attackers can trigger database errors to extract sensitive information including hostnames, IP addresses, connection parameters, and potentially credentials from exception messages.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2(expand)+ 1 more
- (no CPE)
- (no CPE)range: <1.4.0
Patches
Vulnerability mechanics
References
2- github.com/jahlives/openssl_encrypt/security/advisories/GHSA-2vhw-q7vh-7xv2nvdMitigationVendor Advisory
- www.vulncheck.com/advisories/openssl-encrypt-before-information-disclosure-via-ready-endpointnvdThird Party Advisory
News mentions
1- Jahlives openssl_encrypt: 25 Critical Flaws Including Auth Bypass and Sandbox Escapes Disclosed TogetherVypr Intelligence · Aug 17, 2026