Critical severity9.8OSV Advisory· Published Aug 17, 2026· Updated Sep 1, 2026
CVE-2026-74889
CVE-2026-74889
Description
openssl_encrypt versions before 1.4.0 use HKDF with no salt and static info parameter in key normalization functions, reducing entropy extraction and determinism. Attackers can exploit predictable key derivation with identical inputs to weaken cryptographic security against multi-target attacks.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2(expand)+ 1 more
- (no CPE)
- (no CPE)range: <1.4.0
Patches
Vulnerability mechanics
References
2- github.com/jahlives/openssl_encrypt/security/advisories/GHSA-j9mh-57cc-665xnvdMitigationVendor Advisory
- www.vulncheck.com/advisories/openssl-encrypt-before-weak-key-derivation-via-hkdfnvdThird Party Advisory
News mentions
1- Jahlives openssl_encrypt: 25 Critical Flaws Including Auth Bypass and Sandbox Escapes Disclosed TogetherVypr Intelligence · Aug 17, 2026