{"id":"CVE-2026-74876","title":"openssl_encrypt versions before 1.4.0 contain a vulnerability in PublicKeyBundle.from_dict() that creates key bundles from untrusted data without verifying signatures","summary":"openssl_encrypt versions before 1.4.0 contain a vulnerability in PublicKeyBundle.from_dict() that creates key bundles from untrusted data without verifying signatures. Attackers can call from_dict() followed by to_identity() without sign…","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-347"],"vendor":"jahlives","product":"openssl_encrypt","affected":["openssl_encrypt < 1.4.0"],"patched":["openssl_encrypt 1.4.0"],"published":"2026-08-17","updated":"2026-10-08","sourceUpdated":"2026-10-08T16:17:39.410","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-74876","references":[{"url":"https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-8h88-gxp3-j7pg","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openssl-encrypt-before-unverified-key-bundle-encryption","label":"disclosure@vulncheck.com"},{"url":"https://github.com/jahlives/openssl_encrypt/commit/f4a1ba660063cd9e17883829e5272a248525a16b"},{"url":"https://github.com/jahlives/openssl_encrypt"}],"tags":["nvd","cve.org","osv","pip"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"total","timestamp":"2026-08-17T15:41:56.272168Z"},"epss":0.00348,"epssPercentile":0.28227,"aliases":["GHSA-8h88-gxp3-j7pg"],"ecosystem":"pip","ingestedAt":"2026-08-18T12:28:08.512Z","slug":"CVE-2026-74876","body":"## Overview\n\nopenssl_encrypt versions before 1.4.0 contain a vulnerability in PublicKeyBundle.from_dict() that creates key bundles from untrusted data without verifying signatures. Attackers can call from_dict() followed by to_identity() without signature verification to encrypt data using attacker-controlled public keys, leaking secrets.\n\n## Affected\n\n- `openssl_encrypt < 1.4.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `openssl_encrypt 1.4.0`\n\n## Package advisory (CVE-2026-74876)\n\nAffected packages:\n\n- `openssl-encrypt < 1.4.0`\n\nPatched in:\n\n- `openssl-encrypt 1.4.0`\n\nSource: https://osv.dev/vulnerability/GHSA-8h88-gxp3-j7pg","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":53.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":214477,"id":"CVE-2026-74876","ts":1790869829356,"field":"cvss","old":null,"new":"9.8"},{"seq":214476,"id":"CVE-2026-74876","ts":1790869829356,"field":"severity","old":"medium","new":"critical"}]}