CVE-2026-74889: openssl_encrypt before 1.4.0 Weak Key Derivation via HKDF
opensslencrypt versions before 1.4.0 use HKDF with no salt and static info parameter in key normalization functions, reducing entropy extraction and determinism. Attackers can exploit predictable key derivation with identical inputs to weaken cryptographic security against multi-target attacks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openssl_encryptto a version that resolves this vulnerability.Fixed in 1.4.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74889?
CVE-2026-74889 has a critical severity rating of 9.8.
How do I fix CVE-2026-74889?
To fix CVE-2026-74889, upgrade to OpenSSL version 1.4.0 or later.
What kind of vulnerability is CVE-2026-74889?
CVE-2026-74889 is categorized as a weak encryption vulnerability due to insufficient key derivation.
What are the potential impacts of CVE-2026-74889?
CVE-2026-74889 can lead to weakened cryptographic security against multi-target attacks by allowing predictable key derivation.
Is CVE-2026-74889 exploitable remotely?
Yes, CVE-2026-74889 is exploitable remotely due to its nature of key derivation weakness.