CVE-2026-74889

critical · 9.3

openssl_encrypt versions before 1.4.0 use HKDF with no salt and static info parameter in key normalization functions, reducing entropy extraction and determinism. Attackers can exploit predictable key derivation with identical inputs to weaken cryptographic security against multi-target attacks.

9.3

CVSS

0.3%

EPSS (exploit prob.)

26th

EPSS percentile

2026-08-17

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-326

Affected products

Vendor	Product	Affected versions
jahlives	openssl_encrypt	< 1.4.0

Check a specific version with /api/v1/cve/match.

References

https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-j9mh-57cc-665x
https://www.vulncheck.com/advisories/openssl-encrypt-before-weak-key-derivation-via-hkdf

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-74889