CVE-2026-74889

creationtimestamp| type| source ---|---|--- 2026-08-17 12:09:28+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtbo7frpbx2t 2026-08-17 18:50:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtcelr3j5c25 2026-08-18 01:00:27+00:00| seen|...

CVE-2026-74889 openssl_encrypt before 1.4.0 Weak Key Derivation via HKDF

opensslencrypt versions before 1.4.0 use HKDF with no salt and static info parameter in key normalization functions, reducing entropy extraction and determinism. Attackers can exploit predictable key derivation with identical inputs to weaken cryptographic security against multi-target attacks...

CVE-2026-74889

The openssl_encrypt library (PHP package) before version 1.4.0 uses HKDF with no salt and a static info parameter in its key normalization functions, producing deterministic, low-entropy derived keys. Attackers with identical inputs can predict derived keys, weakening cryptographic security again...