CVE-2026-74875
CriticalCVSS 9.8Summary
openssl_encrypt before version 1.4.0 silently skip JSON schema validation when the jsonschema library is not installed, allowing malformed metadata to be accepted. Attackers can remove the jsonschema package or supply unknown metadata format versions to bypass all schema checks and process malicious data.
Risk Assessment
The risk is that malicious data can be processed, potentially leading to unexpected system behavior or further attacks.
Recommendation
It is recommended to upgrade openssl_encrypt to version 1.4.0 or later, which requires schema validation or explicitly errors when jsonschema is missing.
Original NVD description (English source)
openssl_encrypt versions before 1.4.0 silently skip JSON schema validation when the jsonschema library is not installed, allowing malformed metadata to be accepted. Attackers can remove the jsonschema package or supply unknown metadata format versions to bypass all schema checks and process malicious data.