CVE-2026-74889
Received Received - Intake

OpenSSL Encrypt Weak Key Derivation in HKDF Before 1.4.0

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: VulnCheck

Description
openssl_encrypt versions before 1.4.0 use HKDF with no salt and static info parameter in key normalization functions, reducing entropy extraction and determinism. Attackers can exploit predictable key derivation with identical inputs to weaken cryptographic security against multi-target attacks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-17
Last Modified
2026-08-17
Generated
2026-08-17
AI Q&A
2026-08-17
EPSS Evaluated
N/A
NVD
CVE-2026-74889
EUVD
EUVD-2026-60108

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openssl openssl_encrypt to 1.4.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-326 The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The vulnerability in openssl_encrypt versions before 1.4.0 involves the HKDF key normalization function using no salt and a static info parameter. This reduces entropy extraction and makes key derivation deterministic for identical inputs, weakening cryptographic security against multi-target attacks.

Detection Guidance

Check if your system uses openssl_encrypt versions prior to 1.4.0 by running: pip show openssl_encrypt. Examine crypt_core.py and parallel_kdf.py for HKDF usage with salt=None and static info parameter.

Impact Analysis

Attackers could exploit predictable key derivation to weaken encryption, potentially allowing decryption of sensitive data or bypassing security controls. Systems using affected versions may face increased risk of data breaches or unauthorized access.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA due to weakened encryption, potentially exposing personal or health data. Organizations may fail to meet data protection requirements for secure key management and encryption.

Mitigation Strategies

Upgrade openssl_encrypt to version 1.4.0 or later. If using custom code, ensure HKDF salt is passed dynamically and info parameter includes algorithm-specific context.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74889. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart