CVE-2026-74875
openssl_encrypt versions before 1.4.0 silently skip JSON schema validation when the jsonschema library is not installed, allowing malformed metadata to be accepted. Attackers can remove the jsonschema package or supply unknown metadata format versions to bypass all schema checks and process malicious data.
- CVSS 4.0
- 9.3
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 19% of CVEs (scores of 2026-10-25)
- CWE
- CWE-345
- Published
- Modified
- Record from
- the NVD, synced
Affected
- jahlives:openssl_encrypt
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-425g-fjhq-5h92 | PyPI | openssl-encrypt | <1.4.0 | 1.4.0 |
| PYSEC-2026-3755 | PyPI | openssl-encrypt | <1.4.0 | 1.4.0 |