CVE-2026-74887
Description
openssl_encrypt before 1.4.0 imports Python's non-cryptographic 'random' module (Mersenne Twister PRNG) at line 15 of openssl_encrypt/modules/pqc.py. No direct calls to random.* were present in the code, so no cryptographic operation is currently affected; however, the import creates a hazard that future code could inadvertently use random.randint() instead of a cryptographically secure alternative (secrets/os.urandom), producing predictable values since the Mersenne Twister state can be recovered from approximately 624 outputs. Fixed by removing the import in 1.4.0.
How to fix
- jahlives openssl_encrypt1.4.0 or later
- openssl-encrypt1.4.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| jahlives openssl_encrypt | v < 1.4.0 | 1.4.0 |
| openssl-encryptPyPI | v < 1.4.0 | 1.4.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.