Skip to content
CVE PROGRAM SOURCE RECORD9.3 Critical

CVE-2026-74875

openssl_encrypt before 1.4.0 Schema Validation Bypass

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

openssl_encrypt versions before 1.4.0 silently skip JSON schema validation when the jsonschema library is not installed, allowing malformed metadata to be accepted. Attackers can remove the jsonschema package or supply unknown metadata format versions to bypass all schema checks and process malicious data.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

jahlives openssl_encrypt

Default version status: unaffected

  • 0 to < 1.4.0affected
  • 1.4.0unaffected
pkg:pypi/openssl-encrypt

References