CVE-2026-74901
Critical · CVSS 9.8- CVSS
- 9.8
- nvd
- EPSS
- 0.24%
- 15th pct
- KEV
- No
- Class
- oss containerizable
- CWE-347
Description
openssl_encrypt versions before 1.4.0 contain an authentication bypass vulnerability in pqc.py where AES-GCM decryption failures trigger fallback to unauthenticated AES-CTR mode. Attackers can modify ciphertext in transit to bypass integrity verification and perform bit-flipping attacks without detection.
References
Status: profiled · ingested 2026-09-01T18:00:49.000Z