CVE-2026-74876 jahlives CVE debrief

Who should care

Users and administrators of openssl_encrypt versions before 1.4.0 should be aware of this vulnerability and take necessary actions to mitigate the risk. This includes verifying the version of openssl_encrypt in use, implementing compensating controls, and applying vendor-provided patches or updates as soon as available.

Technical summary

The vulnerability exists in openssl_encrypt versions before 1.4.0, specifically in the PublicKeyBundle.from_dict() method, which creates key bundles from untrusted data without verifying signatures. This allows attackers to call from_dict() followed by to_identity() without signature verification to encrypt data using attacker-controlled public keys, potentially leaking secrets. Evidence is based on official CVE and NVD records, as well as vendor advisories. The vulnerability allows attackers to leak secrets by encrypting data with attacker-controlled public keys, highlighting the need for verifying public key bundles before using them for encryption.

Defensive priority

High-priority defensive actions are required due to the critical severity of this vulnerability, which allows attackers to leak secrets by encrypting data with attacker-controlled public keys.

Recommended defensive actions

• Inventory and verify openssl_encrypt versions, checking for versions before 1.4.0.
• Implement compensating controls, such as validating public key bundles before using them for encryption.
• Monitor for potential exploitation attempts and anomalous encryption activities.
• Apply vendor-provided patches or updates to openssl_encrypt as soon as available.
• Review and update encryption key management policies and procedures.

Evidence notes

The vulnerability exists in openssl_encrypt versions before 1.4.0, specifically in the PublicKeyBundle.from_dict() method, which creates key bundles from untrusted data without verifying signatures. This allows attackers to call from_dict() followed by to_identity() without signature verification to encrypt data using attacker-controlled public keys, potentially leaking secrets. Evidence is based on official CVE and NVD records, as well as vendor advisories.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.