CVE-2026-74887
Received Received - Intake

Predictable PRNG Import in OpenSSL Encrypt

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: VulnCheck

Description
openssl_encrypt before 1.4.0 imports Python's non-cryptographic 'random' module (Mersenne Twister PRNG) at line 15 of openssl_encrypt/modules/pqc.py. No direct calls to random.* were present in the code, so no cryptographic operation is currently affected; however, the import creates a hazard that future code could inadvertently use random.randint() instead of a cryptographically secure alternative (secrets/os.urandom), producing predictable values since the Mersenne Twister state can be recovered from approximately 624 outputs. Fixed by removing the import in 1.4.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-17
Last Modified
2026-08-17
Generated
2026-08-17
AI Q&A
2026-08-17
EPSS Evaluated
N/A
NVD
CVE-2026-74887
EUVD
EUVD-2026-60106

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
openssl openssl_encrypt to 1.4.0 (exc)
jahlives openssl_encrypt to 1.4.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-338 The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The vulnerability CVE-2026-74887 involves the openssl_encrypt package importing Python's non-cryptographic 'random' module (Mersenne Twister PRNG) in its Post-Quantum Cryptography module. While no current code uses this module, future developers might accidentally use insecure functions like random.randint() instead of cryptographically secure alternatives. The Mersenne Twister can produce predictable values if its state is recovered from outputs.

Detection Guidance

Check if the openssl_encrypt package version is below 1.4.0 by running: pip show openssl_encrypt. Inspect the file openssl_encrypt/modules/pqc.py for an import statement of the random module at line 15.

Impact Analysis

If exploited, this vulnerability could allow attackers to predict cryptographic values generated by the Mersenne Twister PRNG if misused. This could compromise encryption, authentication, or other security mechanisms relying on randomness. The risk is indirect since the current code does not use the imported module, but future changes might introduce insecure usage.

Compliance Impact

This vulnerability could violate compliance requirements that mandate cryptographically secure random number generation, such as GDPR's data protection principles or HIPAA's security rules for protected health information. Predictable values from insecure PRNGs undermine encryption and authentication, potentially leading to non-compliance.

Mitigation Strategies

Upgrade the openssl_encrypt package to version 1.4.0 or later using: pip install --upgrade openssl_encrypt. Remove any direct or indirect usage of the random module in cryptographic operations and replace with secrets or os.urandom.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74887. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart