CVE-2026-74876: openssl_encrypt before 1.4.0 Unverified Key Bundle Encryption
opensslencrypt versions before 1.4.0 contain a vulnerability in PublicKeyBundle.fromdict() that creates key bundles from untrusted data without verifying signatures. Attackers can call fromdict() followed by toidentity() without signature verification to encrypt data using attacker-controlled public keys, leaking secrets.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openssl_encryptto a version that resolves this vulnerability.Fixed in 1.4.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74876?
CVE-2026-74876 has a severity rating of critical, with a score of 9.8.
How do I fix CVE-2026-74876?
To fix CVE-2026-74876, upgrade to openssl_encrypt version 1.4.0 or later.
What does CVE-2026-74876 affect?
CVE-2026-74876 affects versions of openssl_encrypt prior to 1.4.0.
What type of vulnerability is CVE-2026-74876?
CVE-2026-74876 is an unverified key bundle encryption vulnerability.
What can attackers do with CVE-2026-74876?
Attackers can exploit CVE-2026-74876 to encrypt data using attacker-controlled public keys without verifying signatures.