Read the docs
TI-2026-52591 Aliases CVE-2026-74872GHSA-ccp9-5g7c-pj86

openssl_encrypt before 1.4.0 Arbitrary Code Execution via Whirlpool

Priority MEDIUM 49CWE-426Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-426.

Summary

openssl_encrypt versions before 1.4.0 contain an arbitrary code execution vulnerability in the Whirlpool hash implementation that uses broad glob patterns to load .so modules without integrity verification. Attackers can place malicious .so files matching the whirlpool*py313*.so pattern in site-packages directories to achieve native code execution when the module is loaded.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00679 52nd percentileScored 2026-11-07
Fix Fixed openssl_encrypt (jahlives): 1.4.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
jahlivesopenssl_encryptbefore 1.4.01.4.0Patch availableCNA
  • openssl_encrypt Vendorjahlives Affected before 1.4.0 Fixed in 1.4.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:jahlives:openssl_encrypt:*:*:*:*:*:python:*:*before 1.4.0Vulnerablejahlives
  • cpe:2.3:a:jahlives:openssl_encrypt:*:*:*:*:*:python:*:* Versions before 1.4.0 Vulnerable ·jahlives

Remediation

  • Fix · CNA openssl_encrypt (jahlives) Fixed in 1.4.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    jahlives openssl_encrypt 1.4.0

    28 records Highest priority Priority HIGH 3 HIGH, 21 MEDIUM, 4 LOW

    Other records, highest priority first

    • TI-2026-52616 openssl_encrypt before 1.4.0 Sandbox Escape via Type HierarchyPriority HIGH 81
    • TI-2026-52615 openssl_encrypt before 1.4.0 Sandbox Escape via Dunder Attribute TraversalPriority HIGH 81
    • TI-2026-52602 openssl_encrypt before 1.4.0 Sandbox Bypass via pathlib and ioPriority HIGH 79
    Show all 28 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-74872
  2. 2026-10-03 Alias added: GHSA-ccp9-5g7c-pj86

References

Advisory 1

  • TI-2026-52616 openssl_encrypt before 1.4.0 Sandbox Escape via Type Hierarchy CVSS 4.0CRITICAL 9.3
  • TI-2026-52615 openssl_encrypt before 1.4.0 Sandbox Escape via Dunder Attribute Traversal CVSS 4.0CRITICAL 9.3
  • TI-2026-52602 openssl_encrypt before 1.4.0 Sandbox Bypass via pathlib and io CVSS 4.0HIGH 8.7
  • TI-2026-52617 openssl_encrypt before 1.4.0 Weak Shared Secret via PQC Simulation Mode CVSS 4.0CRITICAL 9.3
  • TI-2026-52614 openssl_encrypt before 1.4.0 Plugin Sandbox Bypass via Process Isolation CVSS 4.0CRITICAL 9.3
  • TI-2026-52613 openssl_encrypt before 1.4.0 Authentication Bypass via Bearer Token CVSS 4.0CRITICAL 9.3
See all 59 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences