---
id: CVE-2026-74872
title: >-
  openssl_encrypt versions before 1.4.0 contain an arbitrary code execution
  vulnerability in the Whirlpool hash implementation that uses broad glob
  patterns to load .so modules without integrity verification
summary: >-
  openssl_encrypt versions before 1.4.0 contain an arbitrary code execution
  vulnerability in the Whirlpool hash implementation that uses broad glob
  patterns to load .so modules without integrity verification. Attackers can
  place malicious …
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-426
vendor: jahlives
product: openssl_encrypt
affected:
  - openssl_encrypt < 1.4.0
patched:
  - openssl_encrypt 1.4.0
published: '2026-08-17'
updated: '2026-10-08'
sourceUpdated: '2026-10-08T16:17:38.797'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-74872'
references:
  - url: >-
      https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-j48q-4c78-rhf9
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/openssl-encrypt-before-arbitrary-code-execution-via-whirlpool
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/jahlives/openssl_encrypt/commit/963d0d1278b722ea134272f9df65fddcd3e6ab47
  - url: 'https://github.com/jahlives/openssl_encrypt'
tags:
  - nvd
  - cve.org
  - osv
  - pip
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-08-18T14:35:28.607190Z'
epss: 0.00679
epssPercentile: 0.52151
aliases:
  - GHSA-j48q-4c78-rhf9
ecosystem: pip
ingestedAt: '2026-08-18T12:28:09.078Z'
---

## Overview

openssl_encrypt versions before 1.4.0 contain an arbitrary code execution vulnerability in the Whirlpool hash implementation that uses broad glob patterns to load .so modules without integrity verification. Attackers can place malicious .so files matching the whirlpool*py313*.so pattern in site-packages directories to achieve native code execution when the module is loaded.

## Affected

- `openssl_encrypt < 1.4.0`

## Remediation

Upgrade past the affected range:

- `openssl_encrypt 1.4.0`

## Package advisory (CVE-2026-74872)

Affected packages:

- `openssl-encrypt < 1.4.0`

Patched in:

- `openssl-encrypt 1.4.0`

Source: https://osv.dev/vulnerability/GHSA-j48q-4c78-rhf9