VULNERABILITY INTELLIGENCE

CVE-2026-74889

CVSS score9.8 CRITICAL
EPSS probability0.35%
CISA KEVNot currently listed
Published2026-08-17
Last modified2026-09-01
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

openssl_encrypt versions before 1.4.0 use HKDF with no salt and static info parameter in key normalization functions, reducing entropy extraction and determinism. Attackers can exploit predictable key derivation with identical inputs to weaken cryptographic security against multi-target attacks.

Weakness classification

  • disclosure@vulncheck.com: CWE-326

Primary references