CVE-2026-74885

Analyzed Analyzed - Analysis Complete

OpenSSL Encrypt Logging Bug and Race Condition in Module Handling

Publication date: 2026-08-17

Last updated on: 2026-09-01

Assigner: VulnCheck

Description

openssl_encrypt versions before 1.4.0 contain a logging bug in restore_hidden_modules() that logs module counts after clearing, always showing zero restored modules and corrupting audit trails. Additionally, a race condition exists between module hiding and import hook installation where another thread could re-import blocked modules in multi-threaded environments.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-17

Last Modified

2026-09-01

Generated

2026-09-08

AI Q&A

2026-08-17

EPSS Evaluated

2026-09-06

NVD

CVE-2026-74885

EUVD

EUVD-2026-60104

Affected Vendors & Products

Vendor	Product	Version / Range
jahlives	openssl_encrypt	to 1.4.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-117	The product constructs a log message from external input, but it does not neutralize or incorrectly neutralizes special elements when the message is written to a log file.

Attack-Flow Graph

Executive Summary

CVE-2026-74885 affects openssl_encrypt versions before 1.4.0 with two issues. First, a logging bug in restore_hidden_modules() shows zero restored modules because it counts after clearing the list, corrupting audit trails. Second, a race condition in hide_dangerous_modules() allows another thread to re-import blocked modules before the import hook is installed.

Detection Guidance

Check openssl_encrypt version with pip show openssl_encrypt or python -c "import openssl_encrypt; print(openssl_encrypt.__version__)". If version is below 1.4.0, the system is vulnerable. Monitor logs for incorrect module restoration messages like 'Restored 0 hidden modules' which indicate the logging bug.

Impact Analysis

The logging bug corrupts audit trails, making it hard to track module changes. The race condition could allow unauthorized module access in multi-threaded environments, potentially leading to security bypasses or data exposure.

Compliance Impact

The logging bug may violate audit requirements in GDPR and HIPAA by corrupting evidence of module changes. Unauthorized module access could also lead to data breaches, failing compliance with data protection standards.

Mitigation Strategies

Upgrade openssl_encrypt to version 1.4.0 or later to address the logging bug and race condition. Implement thread safety measures such as using threading.Lock during module hide/restore operations to prevent race conditions in multi-threaded environments.

Hi! I’m here to help you understand CVE-2026-74885. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70