Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
openssl_encrypt versions before 1.4.0 use a non-standard PBKDF2 key derivation construction with iterations=1 per call in an outer loop, creating a KDF whose security properties have not been formally analyzed. Attackers can exploit this weakened key derivation to more efficiently crack passwords protecting legacy encrypted files compared to standard PBKDF2 implementations.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-74888 Weakened Key Derivation in openssl_encrypt Before 1.4.0 Enables Password Cracking https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-74888
Post summary
The entry announces CVE‑2026‑74888, describing a weakened key derivation in openssl_encrypt that could enable password cracking, but offers no PoC, exploit code, or patch information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | jahlives | openssl_encrypt | - | python | - |