CVE-2026-74879
HighCVSS 7.5Summary
openssl_encrypt before version 1.4.0 contains an information disclosure vulnerability in the /ready endpoint that returns full database exception strings to unauthenticated callers. Attackers can trigger database errors to extract sensitive information including hostnames, IP addresses, connection parameters, and potentially credentials from exception messages.
Risk Assessment
The risk includes disclosure of sensitive infrastructure information, which can facilitate further attacks and security breaches.
Recommendation
It is recommended to upgrade openssl_encrypt to version 1.4.0 or later and restrict access to the /ready endpoint to prevent detailed error disclosure.
Original NVD description (English source)
openssl_encrypt versions before 1.4.0 contain an information disclosure vulnerability in the /ready endpoint that returns full database exception strings to unauthenticated callers. Attackers can trigger database errors to extract sensitive information including hostnames, IP addresses, connection parameters, and potentially credentials from exception messages.