CVE-2026-74885: openssl_encrypt before 1.4.0 Logging Bug and Race Condition
opensslencrypt versions before 1.4.0 contain a logging bug in restorehiddenmodules() that logs module counts after clearing, always showing zero restored modules and corrupting audit trails. Additionally, a race condition exists between module hiding and import hook installation where another thread could re-import blocked modules in multi-threaded environments.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openssl_encryptto a version that resolves this vulnerability.Fixed in 1.4.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74885?
CVE-2026-74885 has a low severity score of 3.6.
How do I fix CVE-2026-74885?
To fix CVE-2026-74885, upgrade to OpenSSL Encrypt version 1.4.0 or later.
What does CVE-2026-74885 affect?
CVE-2026-74885 affects versions of OpenSSL Encrypt prior to 1.4.0.
What type of vulnerabilities does CVE-2026-74885 include?
CVE-2026-74885 includes a logging bug and a race condition.
What are the implications of CVE-2026-74885?
CVE-2026-74885 can corrupt audit trails due to incorrect logging of module counts.