{"cve":"CVE-2026-74872","nvd":{"published":"2026-08-17T11:16:41.560","modified":"2026-10-08T16:17:38.797","status":"Analyzed","description":"openssl_encrypt versions before 1.4.0 contain an arbitrary code execution vulnerability in the Whirlpool hash implementation that uses broad glob patterns to load .so modules without integrity verification. Attackers can place malicious .so files matching the whirlpool*py313*.so pattern in site-packages directories to achieve native code execution when the module is loaded.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","score":9.3},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8},"cwes":["CWE-426"],"references":["https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-j48q-4c78-rhf9","https://www.vulncheck.com/advisories/openssl-encrypt-before-arbitrary-code-execution-via-whirlpool"],"products":["jahlives:openssl_encrypt"],"source":"nvd","synced_at":"2026-10-19T22:49:10.689564601+00:00"},"epss":{"cve":"CVE-2026-74872","score":0.00679,"percentile":0.52071,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-j48q-4c78-rhf9","url":"https://osv.dev/vulnerability/GHSA-j48q-4c78-rhf9","summary":"openssl-encrypt: Dynamic .so loading for Whirlpool uses broad glob pattern without integrity verification","modified":"2026-09-01T09:25:19.420612443Z","packages":[{"ecosystem":"PyPI","name":"openssl-encrypt","purl":"pkg:pypi/openssl-encrypt","ranges":["<1.4.0"],"fixed":["1.4.0"]}]},{"id":"PYSEC-2026-3742","url":"https://osv.dev/vulnerability/PYSEC-2026-3742","summary":"","modified":"2026-09-01T09:15:03.518097029Z","packages":[{"ecosystem":"PyPI","name":"openssl-encrypt","purl":"pkg:pypi/openssl-encrypt","ranges":["<1.4.0"],"fixed":["1.4.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}