CVE-2026-74876: Improper Verification of Cryptographic Signature

opensslencrypt versions before 1.4.0 contain a vulnerability in PublicKeyBundle.fromdict that creates key bundles from untrusted data without verifying signatures. Attackers can call fromdict followed by toidentity without signature verification to encrypt data using attacker-controlled public...

PT-2026-76612

openssl encrypt versions before 1.4.0 contain a vulnerability in PublicKeyBundle.from dict that creates key bundles from untrusted data without verifying signatures. Attackers can call from dict followed by to identity without signature verification to encrypt data using attacker-controlled publi...

PT-2026-32133

Summary The PublicKeyBundle.from dict method in openssl encrypt/modules/key bundle.py at lines 329-361 creates bundles from untrusted data without verifying the signature. The docstring warns to call verify signature after creation, but the to identity method line 363-391 can convert an unverifie...