High severity7.5OSV Advisory· Published Aug 17, 2026· Updated Sep 1, 2026
CVE-2026-74888
CVE-2026-74888
Description
openssl_encrypt versions before 1.4.0 use a non-standard PBKDF2 key derivation construction with iterations=1 per call in an outer loop, creating a KDF whose security properties have not been formally analyzed. Attackers can exploit this weakened key derivation to more efficiently crack passwords protecting legacy encrypted files compared to standard PBKDF2 implementations.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2<1.4.0+ 1 more
- (no CPE)range: <1.4.0
- (no CPE)
Patches
Vulnerability mechanics
References
2- github.com/jahlives/openssl_encrypt/security/advisories/GHSA-743f-89fg-x288nvdVendor Advisory
- www.vulncheck.com/advisories/openssl-encrypt-before-non-standard-pbkdf2-key-derivationnvdThird Party Advisory
News mentions
1- Jahlives openssl_encrypt: 25 Critical Flaws Including Auth Bypass and Sandbox Escapes Disclosed TogetherVypr Intelligence · Aug 17, 2026