CVE-2026-74885
Low · 3.6CVSS
3.6
EPSS
—
Published
Aug 17, 2026
CISA due date
—
The record
openssl_encrypt versions before 1.4.0 contain a logging bug in restore_hidden_modules() that logs module counts after clearing, always showing zero restored modules and corrupting audit trails. Additionally, a race condition exists between module hiding and import hook installation where another thread could re-import blocked modules in multi-threaded environments.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-109786 In fail2ban 0.10.5 through 1.1.1 before ddd879d, the sshd filter… CWE-117
- CVE-2026-87859 morgan is an HTTP request logger middleware for Node.js. CWE-117
- CVE-2026-14350 IBM Cloud Pak for Data System 11.3.0.2 through Interim Fix 001 could allow an… CWE-117
- CVE-2026-9736 IBM Netezza Software 11.3.0.3 through Interim Fix 002 could allow an unauthorized user to… CWE-117
- CVE-2026-15603 morgan is an HTTP request logger middleware for Node.js. CWE-117
- CVE-2026-81694 openssl-encrypt (pip package, versions <= 1.4.8) fails to sanitize filenames read from… CWE-117
- CVE-2026-81695 openssl_encrypt versions before 1.4.9 fail to escape attacker-controlled key_id values… CWE-117
- CVE-2026-81696 openssl_encrypt versions before 1.4.9 fail to sanitize terminal control characters in… CWE-117