CVE-2026-74901

CriticalCVSS 9.8

Published: 17/08/2026(UTC)Translated: 17/08/2026(UTC)NVD NIST

Summary

openssl_encrypt before version 1.4.0 contains an authentication bypass vulnerability in pqc.py where AES-GCM decryption failures trigger fallback to unauthenticated AES-CTR mode. Attackers can modify ciphertext in transit to bypass integrity verification and perform bit-flipping attacks without detection.

Risk Assessment

The risk is that data integrity in transit can be compromised undetected, potentially leading to data manipulation or injection of malicious content.

Recommendation

It is recommended to immediately upgrade openssl_encrypt to version 1.4.0 or later, which eliminates this vulnerability.

Original NVD description (English source)

openssl_encrypt versions before 1.4.0 contain an authentication bypass vulnerability in pqc.py where AES-GCM decryption failures trigger fallback to unauthenticated AES-CTR mode. Attackers can modify ciphertext in transit to bypass integrity verification and perform bit-flipping attacks without detection.