CVE-2026-74885
Received Received - Intake

OpenSSL Encrypt Logging Bug and Race Condition in Module Handling

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: VulnCheck

Description
openssl_encrypt versions before 1.4.0 contain a logging bug in restore_hidden_modules() that logs module counts after clearing, always showing zero restored modules and corrupting audit trails. Additionally, a race condition exists between module hiding and import hook installation where another thread could re-import blocked modules in multi-threaded environments.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-17
Last Modified
2026-08-17
Generated
2026-08-17
AI Q&A
2026-08-17
EPSS Evaluated
N/A
NVD
CVE-2026-74885
EUVD
EUVD-2026-60104

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-117 The product constructs a log message from external input, but it does not neutralize or incorrectly neutralizes special elements when the message is written to a log file.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-74885 affects openssl_encrypt versions before 1.4.0 with two issues. First, a logging bug in restore_hidden_modules() shows zero restored modules because it counts after clearing the list, corrupting audit trails. Second, a race condition in hide_dangerous_modules() allows another thread to re-import blocked modules before the import hook is installed.

Detection Guidance

Check openssl_encrypt version with pip show openssl_encrypt or python -c "import openssl_encrypt; print(openssl_encrypt.__version__)". If version is below 1.4.0, the system is vulnerable. Monitor logs for incorrect module restoration messages like 'Restored 0 hidden modules' which indicate the logging bug.

Impact Analysis

The logging bug corrupts audit trails, making it hard to track module changes. The race condition could allow unauthorized module access in multi-threaded environments, potentially leading to security bypasses or data exposure.

Compliance Impact

The logging bug may violate audit requirements in GDPR and HIPAA by corrupting evidence of module changes. Unauthorized module access could also lead to data breaches, failing compliance with data protection standards.

Mitigation Strategies

Upgrade openssl_encrypt to version 1.4.0 or later to address the logging bug and race condition. Implement thread safety measures such as using threading.Lock during module hide/restore operations to prevent race conditions in multi-threaded environments.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74885. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart