Vulnerability Details CVE-2026-74887
openssl_encrypt before 1.4.0 imports Python's non-cryptographic 'random' module (Mersenne Twister PRNG) at line 15 of openssl_encrypt/modules/pqc.py. No direct calls to random.* were present in the code, so no cryptographic operation is currently affected; however, the import creates a hazard that future code could inadvertently use random.randint() instead of a cryptographically secure alternative (secrets/os.urandom), producing predictable values since the Mersenne Twister state can be recovered from approximately 624 outputs. Fixed by removing the import in 1.4.0.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 8.5%
CVSS Severity
CVSS v3 Score 3.7
References
Products affected by CVE-2026-74887
-
cpe:2.3:a:jahlives:openssl_encrypt:0.2.2
-
cpe:2.3:a:jahlives:openssl_encrypt:0.2.3
-
cpe:2.3:a:jahlives:openssl_encrypt:0.2.4
-
cpe:2.3:a:jahlives:openssl_encrypt:0.2.5
-
cpe:2.3:a:jahlives:openssl_encrypt:0.2.6
-
cpe:2.3:a:jahlives:openssl_encrypt:0.3.0
-
cpe:2.3:a:jahlives:openssl_encrypt:0.3.1
-
cpe:2.3:a:jahlives:openssl_encrypt:0.3.2
-
cpe:2.3:a:jahlives:openssl_encrypt:0.3.3
-
cpe:2.3:a:jahlives:openssl_encrypt:0.4.0
-
cpe:2.3:a:jahlives:openssl_encrypt:0.4.1
-
cpe:2.3:a:jahlives:openssl_encrypt:0.4.2
-
cpe:2.3:a:jahlives:openssl_encrypt:0.4.3
-
cpe:2.3:a:jahlives:openssl_encrypt:0.4.4
-
cpe:2.3:a:jahlives:openssl_encrypt:0.5.0
-
cpe:2.3:a:jahlives:openssl_encrypt:0.5.1
-
cpe:2.3:a:jahlives:openssl_encrypt:0.5.3
-
cpe:2.3:a:jahlives:openssl_encrypt:0.6.0
-
cpe:2.3:a:jahlives:openssl_encrypt:0.7.0
-
cpe:2.3:a:jahlives:openssl_encrypt:0.7.1
-
cpe:2.3:a:jahlives:openssl_encrypt:0.7.2
-
cpe:2.3:a:jahlives:openssl_encrypt:0.8.0
-
cpe:2.3:a:jahlives:openssl_encrypt:0.8.1
-
cpe:2.3:a:jahlives:openssl_encrypt:0.8.2
-
cpe:2.3:a:jahlives:openssl_encrypt:0.9.2
-
cpe:2.3:a:jahlives:openssl_encrypt:1.0.0
-
cpe:2.3:a:jahlives:openssl_encrypt:1.0.1
-
cpe:2.3:a:jahlives:openssl_encrypt:1.0.2
-
cpe:2.3:a:jahlives:openssl_encrypt:1.0.3
-
cpe:2.3:a:jahlives:openssl_encrypt:1.1.0
-
cpe:2.3:a:jahlives:openssl_encrypt:1.2.0
-
cpe:2.3:a:jahlives:openssl_encrypt:1.2.1
-
cpe:2.3:a:jahlives:openssl_encrypt:1.3.0
-
cpe:2.3:a:jahlives:openssl_encrypt:1.3.1
-
cpe:2.3:a:jahlives:openssl_encrypt:1.3.2
-
cpe:2.3:a:jahlives:openssl_encrypt:1.3.3
-
cpe:2.3:a:jahlives:openssl_encrypt:1.3.4
-
cpe:2.3:a:jahlives:openssl_encrypt:1.3.5
-
cpe:2.3:a:jahlives:openssl_encrypt:1.3.6