CVE-2026-74875: Jahlives OpenSSL Encrypt

Critical severity, CVSS 9.8. EPSS: 0.3% chance of exploitation in the next 30 days.

openssl_encrypt versions before 1.4.0 silently skip JSON schema validation when the jsonschema library is not installed, allowing malformed metadata to be accepted. Attackers can remove the jsonschema package or supply unknown metadata format versions to bypass all schema checks and process malicious data.

Affected products

• Jahlives OpenSSL Encrypt: before 1.4.0 (fixed in 1.4.0)

Published 2026-08-17. Last modified 2026-10-08.