Which versions of openssl_encrypt are affected by CVE-2026-74885?

The openssl_encrypt Python library (versions before 1.4.0) contains critical vulnerabilities in its module-hiding defenses and audit-trail mechanisms that could allow attackers to bypass security…. A patch is available.

How to fix or mitigate CVE-2026-74885?

Within 24 hours, identify and inventory all systems using the openssl_encrypt Python library and determine current version numbers to establish the scope of exposure. Within 7 days, upgrade all affected systems to version 1.4.0, then validate that module-hiding and import-hook functionality operates correctly and that audit logging now accurately records module restoration events. Within 30 days, conduct a forensic review of pre-patch audit logs to identify any periods of suspicious gaps or zero-module-restoration entries that may indicate prior exploitation or control bypass.

openssl_encrypt CVE-2026-74885

Q: What is the CVSS score of CVE-2026-74885?

CVE-2026-74885 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-60104 CRITICAL

Improper Output Neutralization for Logs (CWE-117)

2026-08-17 VulnCheck

GHSA-9j5f-pjwj-62r3

Information Disclosure Openssl Encrypt Jahlives

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

2.5 LOW

Exploiting the race needs in-process code and precise timing (AV:L, AC:H, PR:L); impact is limited to bypassing a security control and corrupting audit integrity (I:L), with no confidentiality or availability loss.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 13:10 vuln.today

Patch available

Aug 17, 2026 - 12:01 EUVD

CVE Published

Aug 17, 2026 - 11:04 cve.org

CRITICAL 9.3

DescriptionCVE.org

openssl_encrypt versions before 1.4.0 contain a logging bug in restore_hidden_modules() that logs module counts after clearing, always showing zero restored modules and corrupting audit trails. Additionally, a race condition exists between module hiding and import hook installation where another thread could re-import blocked modules in multi-threaded environments.

AnalysisAI

Audit-trail corruption and a security-control race condition in the Python library openssl_encrypt (by jahlives) before version 1.4.0 undermine its module-hiding defenses. The restore_hidden_modules() function logs module counts after clearing them, so it always records zero restored modules and produces misleading audit logs (CWE-117), while a separate time-of-check/time-of-use race between module hiding and import-hook installation lets a concurrent thread re-import modules that were meant to be blocked. Reported by VulnCheck with a vendor patch available; no public exploit identified at time of analysis and it is not on CISA KEV.

Technical ContextAI

openssl_encrypt is a Python encryption utility package (CPE cpe:2.3:a:jahlives:openssl_encrypt) that implements a defensive feature to hide/block specific modules and install an import hook to prevent their reloading. The first issue is a CWE-117 (Improper Output Neutralization / incorrect logging) defect: restore_hidden_modules() emits the count of modules only after the internal collection has been cleared, so the log statement always reports zero, defeating the audit trail that would otherwise show what was restored. The second issue is a classic race condition (TOCTOU) in a multi-threaded context: there is a window between when modules are hidden and when the import hook is fully installed during which another thread can perform an import and reload a module that was supposed to remain blocked, bypassing the intended restriction.

RemediationAI

Upgrade openssl_encrypt to version 1.4.0 or later (Vendor-released patch: 1.4.0), which corrects both the restore_hidden_modules() log-count ordering and the module-hiding/import-hook race; follow the vendor advisory at https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-43r4-3hf9-m84q. If you cannot upgrade immediately, reduce exposure to the race condition by avoiding concurrent imports during the module-hiding phase - perform module hiding and import-hook installation before spawning worker threads or under a global lock so no other thread runs imports in the window, accepting the trade-off of serialized startup. For the audit-trail defect, do not rely on the restored-module count emitted by restore_hidden_modules() as an accurate control until patched, and corroborate module-restore events with independent logging; there is no functional workaround that restores correct counts short of the patch.