CVE-2026-74888: openssl_encrypt before 1.4.0 Non-Standard PBKDF2 Key Derivation
opensslencrypt versions before 1.4.0 use a non-standard PBKDF2 key derivation construction with iterations=1 per call in an outer loop, creating a KDF whose security properties have not been formally analyzed. Attackers can exploit this weakened key derivation to more efficiently crack passwords protecting legacy encrypted files compared to standard PBKDF2 implementations.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openssl_encryptto a version that resolves this vulnerability.Fixed in 1.4.0 - Compensating control
For legacy encrypted files produced with openssl_encrypt versions before 1.4.0, treat their password protection as weakened and require stronger authentication/compensating access controls until those files are re-encrypted with a secure KDF construction.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74888?
CVE-2026-74888 has a high severity rating of 7.5.
How do I fix CVE-2026-74888?
To fix CVE-2026-74888, upgrade to OpenSSL encrypt version 1.4.0 or later.
What are the implications of CVE-2026-74888?
CVE-2026-74888 can lead to the efficient cracking of passwords due to a weakened key derivation method.
What software is affected by CVE-2026-74888?
CVE-2026-74888 affects versions of OpenSSL encrypt before 1.4.0.
When was CVE-2026-74888 published?
CVE-2026-74888 was published on August 17, 2026.