CVE-2026-74889
Critical · 9.8CVSS
9.8
EPSS
—
Published
Aug 17, 2026
CISA due date
—
The record
openssl_encrypt versions before 1.4.0 use HKDF with no salt and static info parameter in key normalization functions, reducing entropy extraction and determinism. Attackers can exploit predictable key derivation with identical inputs to weaken cryptographic security against multi-target attacks.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-112026 A security vulnerability has been detected in light0011 cms… CWE-326
- CVE-2026-77405 RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. CWE-326
- CVE-2026-86670 A flaw has been found in aircheng-org iWebShop-5 up to 5.15. CWE-326
- CVE-2026-17520 The Newsletters WordPress plugin before 4.17 does not generate its API key using a… CWE-326
- CVE-2026-47842 Applications using AesBytesEncryptor with the two-argument constructor or when passing a… CWE-326
- CVE-2026-79084 Inadequate encryption strength in Notifications in Google Chrome on on Windows prior to… CWE-326
- CVE-2026-65777 Inadequate encryption strength in Windows Active Directory allows an authorized attacker… CWE-326
- CVE-2026-9201 IBM Langflow OSS 1.0.0 through 1.10.3 could allow an authenticated attacker to execute… CWE-326