EUVD-2026-60117
GHSA-7qj7-jv8m-rfjw
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote and unauthenticated, but AC:H because exploitation requires obtaining 16 specific private-key bytes plus a KEM failure; impact is confidentiality loss of decrypted data, with no direct integrity or availability effect.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
openssl_encrypt versions before 1.4.0 contain a critical vulnerability in pqc.py where KEM decapsulation failures silently fall back to simulation mode, generating a deterministic shared secret from only 16 bytes of the private key and publicly available encapsulated key data. Attackers who obtain 16 bytes of the private key can compute the shared secret and decrypt all ciphertext, as the fallback triggers on any KEM failure without raising an error.
AnalysisAI
Cryptographic shared-secret disclosure in the openssl_encrypt Python library (maintainer 'jahlives') before 1.4.0 lets an attacker reconstruct the KEM shared secret and decrypt all protected ciphertext once they obtain only 16 bytes of the private key. The flaw lives in pqc.py, where any post-quantum KEM decapsulation failure silently falls back to a 'simulation mode' that derives a deterministic secret from those 16 key bytes plus attacker-visible encapsulated-key data, rather than raising an error. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Two concrete prerequisites drive exploitation: (1) the KEM decapsulation path in pqc.py must fail so the silent 'simulation mode' fallback engages - this happens on any KEM error and, critically, without any exception being raised; and (2) the attacker must obtain 16 bytes of the target's private key, since the fallback shared secret is derived deterministically from exactly those 16 bytes plus the publicly available encapsulated key. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N/VC:H/VI:H/VA:H, 9.3) treats this as a network, no-privilege, high-impact break, but the description imposes a concrete precondition that the vector does not capture: the attacker must possess 16 bytes of the private key (128 bits), which is not brute-forceable and implies some prior key exposure or a side channel - so real-world exploitability is meaningfully lower than a raw 9.3 suggests, and I would rate attack complexity as high rather than low. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has captured ciphertext produced by openssl_encrypt <1.4.0 and who has separately obtained 16 bytes of the target's private key (via a partial leak, backup exposure, or side channel) combines those bytes with the public encapsulated-key data to recompute the deterministic shared secret and decrypt the traffic. In a worse variant, if the deployment's KEM backend fails every time, all messages are already protected only by this weak secret, so the partial key leak yields full plaintext. … |
| Remediation | Vendor-released patch: upgrade openssl_encrypt to version 1.4.0 or later, which is the primary and complete fix per GHSA-p3gq-pcg9-qvfv. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all systems and applications using openssl_encrypt and identify current versions deployed. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Openssl Encrypt
View allArbitrary native code execution in the jahlives openssl_encrypt Python package (all versions before 1.4.0) arises from i
Sandbox escape in the openssl_encrypt Python library (jahlives) before 1.4.0 lets attacker-supplied plugin code break ou
Insecure PRNG import in the jahlives openssl_encrypt Python package (all versions before 1.4.0) places Python's non-cryp
Authentication bypass in the openssl_encrypt Python library (versions before 1.4.0) lets attackers who can tamper with c
Sandbox escape leading to remote code execution affects openssl_encrypt (the jahlives Python package) in all versions be
Sandbox escape in the openssl_encrypt Python library (jahlives) before 1.4.0 allows attacker-supplied plugins to run wit
Authentication bypass in the jahlives openssl_encrypt library (all versions before 1.4.0) lets remote unauthenticated at
Integrity-protection bypass in the jahlives openssl_encrypt Python library (all versions before 1.4.0) lets an attacker
Weak cryptographic key derivation in the openssl_encrypt Python library (all versions before 1.4.0) stems from its key-n
Arbitrary code execution in jahlives openssl_encrypt before 1.4.0 stems from an inconsistent sandbox: the runtime Plugin
Audit-trail corruption and a security-control race condition in the Python library openssl_encrypt (by jahlives) before
Sensitive-token exposure in openssl_encrypt (the jahlives Python package, pip 'openssl-encrypt') before 1.4.0 stems from
Same weakness CWE-391 – Unchecked Error Condition
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today