Description
openssl_encrypt versions before 1.4.0 silently skip JSON schema validation when the jsonschema library is not installed, allowing malformed metadata to be accepted. Attackers can remove the jsonschema package or supply unknown metadata format versions to bypass all schema checks and process malicious data.
Published: 2026-08-17
Score: 9.3 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability in openssl_encrypt causes the library to silently skip JSON schema validation when the jsonschema dependency is missing. This allows attackers to inject malformed or malicious metadata that is otherwise rejected, potentially leading to arbitrary processing of data and the execution of unintended behaviors.

Affected Systems

The affected software is the openssl_encrypt library maintained by jahlives. Versions prior to 1.4.0 are impacted. Users running any of these releases should verify their installed version and upgrade when possible.

Risk and Exploitability

The CVSS score of 9.3 marks this vulnerability as critical. EPSS data is not available, and the flaw is not listed in CISA KEV, yet the high score indicates significant potential impact. Attackers can exploit the weakness by removing or omitting the jsonschema package or by supplying metadata that declares unknown format versions, thereby bypassing all schema checks. The likely attack vector is local or remote, depending on how the library processes externally supplied metadata.

Generated by OpenCVE AI on August 17, 2026 at 13:11 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade openssl_encrypt to version 1.4.0 or later
  • Install the jsonschema package to enable schema validation if not already present
  • Enforce proper authorization checks before processing metadata to mitigate CWE-345

Generated by OpenCVE AI on August 17, 2026 at 13:11 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 01 Sep 2026 22:00:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:jahlives:openssl_encrypt:*:*:*:*:*:python:*:*

Fri, 21 Aug 2026 13:00:00 +0000

Type Values Removed Values Added
First Time appeared Jahlives
Jahlives openssl Encrypt
Vendors & Products Jahlives
Jahlives openssl Encrypt

Mon, 17 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 17 Aug 2026 11:15:00 +0000

Type Values Removed Values Added
Description openssl_encrypt versions before 1.4.0 silently skip JSON schema validation when the jsonschema library is not installed, allowing malformed metadata to be accepted. Attackers can remove the jsonschema package or supply unknown metadata format versions to bypass all schema checks and process malicious data.
Title openssl_encrypt before 1.4.0 Schema Validation Bypass
Weaknesses CWE-345
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Jahlives Openssl Encrypt
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-08-17T15:15:05.482Z

Reserved: 2026-08-17T10:31:04.593Z

Link: CVE-2026-74875

cve-icon Vulnrichment

Updated: 2026-08-17T15:15:00.598Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-17T11:16:41.943

Modified: 2026-09-01T15:28:53.623

Link: CVE-2026-74875

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T12:41:05Z

Weaknesses
  • CWE-345

    Insufficient Verification of Data Authenticity