CVE-2026-74875

Critical · CVSS 9.8

CVSS: 9.8; nvd
EPSS: 0.27%; 18th pct
KEV: No
Class: oss containerizable; CWE-345

Description

openssl_encrypt versions before 1.4.0 silently skip JSON schema validation when the jsonschema library is not installed, allowing malformed metadata to be accepted. Attackers can remove the jsonschema package or supply unknown metadata format versions to bypass all schema checks and process malicious data.

Affected packages

PyPI

openssl-encrypt

0 → 1.4.0

References

https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-425g-fjhq-5h92
https://www.vulncheck.com/advisories/openssl-encrypt-before-schema-validation-bypass

Status: profiled · ingested 2026-09-01T18:00:49.000Z