---
id: CVE-2026-74889
title: openssl_encrypt before 1.4.0 Weak Key Derivation via HKDF
summary: >-
  openssl_encrypt versions before 1.4.0 use HKDF with no salt and static info
  parameter in key normalization functions, reducing entropy extraction and
  determinism. Attackers can exploit predictable key derivation with identical
  inputs to …
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-326
vendor: jahlives
product: openssl_encrypt
affected:
  - openssl_encrypt < 1.4.0
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-08-17T16:00:53.861001Z'
published: '2026-08-17'
updated: '2026-10-01'
sourceUpdated: '2026-10-01T15:20:59.922Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-74889'
references:
  - url: >-
      https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-j9mh-57cc-665x
    label: GitHub Security Advisory (GHSA-j9mh-57cc-665x)
  - url: >-
      https://www.vulncheck.com/advisories/openssl-encrypt-before-weak-key-derivation-via-hkdf
    label: >-
      VulnCheck Advisory: openssl_encrypt before 1.4.0 Weak Key Derivation via
      HKDF
tags:
  - cve.org
  - osv
  - pip
epss: 0.00348
epssPercentile: 0.28227
aliases:
  - PYSEC-2026-3765
  - GHSA-j9mh-57cc-665x
ecosystem: pip
patched:
  - openssl-encrypt 1.4.0
ingestedAt: '2026-09-02T19:31:25.619Z'
---

## Overview

openssl_encrypt versions before 1.4.0 use HKDF with no salt and static info parameter in key normalization functions, reducing entropy extraction and determinism. Attackers can exploit predictable key derivation with identical inputs to weaken cryptographic security against multi-target attacks.

## Affected

- `openssl_encrypt < 1.4.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-74889)

Affected packages:

- `openssl-encrypt < 1.4.0`

Patched in:

- `openssl-encrypt 1.4.0`

Source: https://osv.dev/vulnerability/PYSEC-2026-3765