openssl_encrypt versions prior to 1.4.0 contain a logging bug in the restore_hidden_modules() function. When modules are hidden, the function clears the module count and then logs the number of restored modules, but it reports zero even when modules are successfully restored. This behavior corrupts audit trails, making it difficult to detect unauthorized module use or tampering. Additionally, a race condition exists between module hiding and the import hook installation, allowing another thread to re‑import blocked modules in multi‑threaded environments. The combination of inaccurate audit records and the race condition can enable an attacker to bypass security controls or cover malicious activity by exploiting timing differences.

The vulnerability affects the openssl_encrypt library provided by the vendor jahlives. All releases before version 1.4.0 are susceptible. The product is commonly used in Python applications that perform cryptographic operations and module import monitoring.

The CVSS score of 9.3 indicates a high severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector involves an application that performs concurrent module hiding and imports under a multi‑threaded runtime. An attacker who can influence the timing of these operations may trigger the race condition to re‑import hidden modules, while the corrupted logs provide plausible deniability. Although a precise exploitation path is not detailed in the advisory, the high severity and absence of known mitigations suggest that the vulnerability poses a significant risk in environments that rely on the compromised library.