CVE-2026-74887
Low · 3.7CVSS
3.7
EPSS
—
Published
Aug 17, 2026
CISA due date
—
The record
openssl_encrypt before 1.4.0 imports Python's non-cryptographic 'random' module (Mersenne Twister PRNG) at line 15 of openssl_encrypt/modules/pqc.py. No direct calls to random.* were present in the code, so no cryptographic operation is currently affected; however, the import creates a hazard that future code could inadvertently use random.randint() instead of a cryptographically secure alternative (secrets/os.urandom), producing predictable values since the Mersenne Twister state can be recovered from approximately 624 outputs. Fixed by removing the import in 1.4.0.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-71851 crypto-js is a JavaScript library of crypto standards. CWE-338
- CVE-2026-16615 A flaw was found in librest. CWE-338
- CVE-2026-14495 The DoLogin Security plugin for WordPress is vulnerable to Authentication Bypass via… CWE-338
- CVE-2026-7830 UltraVNC through 1.8.2.2 uses inadequate cryptography in the MS-Logon II authentication… CWE-338
- CVE-2026-44040 UltraVNC through 1.8.2.2 uses a cryptographically weak pseudo-random number generator to… CWE-338
- CVE-2026-9733 Mojolicious::Plugin::Web::Auth::OAuth2 versions through 0.17 for Perl have an insecure… CWE-338
- CVE-2026-56141 In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120… CWE-338
- CVE-2026-9692 Mojolicious::Sessions::Storable versions through 0.05 for Perl generate session ids… CWE-338