CVE-2026-74875: openssl_encrypt before 1.4.0 Schema Validation Bypass
opensslencrypt versions before 1.4.0 silently skip JSON schema validation when the jsonschema library is not installed, allowing malformed metadata to be accepted. Attackers can remove the jsonschema package or supply unknown metadata format versions to bypass all schema checks and process malicious data.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
jsonschemato a version that resolves this vulnerability.Fixed in 1.4.0 - Compensating control
Ensure the jsonschema library is installed and available so that JSON schema validation is not silently skipped.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74875?
CVE-2026-74875 has a critical severity rating of 9.8.
How do I fix CVE-2026-74875?
To fix CVE-2026-74875, upgrade to openssl_encrypt version 1.4.0 or later.
What does CVE-2026-74875 exploit?
CVE-2026-74875 exploits a schema validation bypass in openssl_encrypt due to missing JSON schema validation.
What are the potential impacts of CVE-2026-74875?
The potential impacts of CVE-2026-74875 include acceptance of malformed metadata and processing of malicious data.
Who is affected by CVE-2026-74875?
CVE-2026-74875 affects users of openssl_encrypt versions prior to 1.4.0.