{"id":"CVE-2026-74875","aliases":["EUVD-2026-60094","GHSA-425g-fjhq-5h92","GHSA-m3pp-5f32-32h9","PYSEC-2026-3755"],"status":"published","title":"openssl_encrypt before 1.4.0 Schema Validation Bypass","description":"openssl_encrypt versions before 1.4.0 silently skip JSON schema validation when the jsonschema library is not installed, allowing malformed metadata to be accepted. Attackers can remove the jsonschema package or supply unknown metadata format versions to bypass all schema checks and process malicious data.","severity":{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00274,"percentile":0.19968,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20","CWE-345"],"published":"2026-03-31T23:43:33Z","modified":"2026-10-28T02:30:42Z","fixes":[{"ecosystem":"PyPI","package":"openssl-encrypt","fixed_in":["1.4.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"openssl-encrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0"}]}]},{"source":"osv","ecosystem":"PyPI","package":"openssl-encrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0"}]}],"versions":["0.2.2","0.2.3","0.2.4","0.2.5","0.2.6","0.3.0","0.3.1","0.3.2","0.3.3","0.4.0","0.4.1","0.4.2","0.4.3","0.4.4","0.5.0","0.5.1","0.5.3","0.6.0rc1","0.7.0rc2","0.7.1","0.7.2","0.8.0","0.8.1","0.8.2","0.9.2","1.0.0","1.0.1","1.0.2","1.0.3","1.1.0","1.2.0","1.2.1","1.3.0","1.3.1","1.3.2","1.3.3","1.3.4","1.3.5","1.4.0b3","1.4.0b4","1.4.0b5","1.4.0b6","1.4.0b7","1.4.0b8"]},{"source":"osv","ecosystem":"PyPI","package":"openssl-encrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0"}]}],"versions":["0.2.2","0.2.3","0.2.4","0.2.5","0.2.6","0.3.0","0.3.1","0.3.2","0.3.3","0.4.0","0.4.1","0.4.2","0.4.3","0.4.4","0.5.0","0.5.1","0.5.3","0.6.0rc1","0.7.0rc2","0.7.1","0.7.2","0.8.0","0.8.1","0.8.2","0.9.2","1.0.0","1.0.1","1.0.2","1.0.3","1.1.0","1.2.0","1.2.1","1.3.0","1.3.1","1.3.2","1.3.3","1.3.4","1.3.5","1.4.0b3","1.4.0b4","1.4.0b5","1.4.0b6","1.4.0b7","1.4.0b8"]}],"products":[{"vendor":"jahlives","product":"openssl_encrypt"}],"references":[{"url":"https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-425g-fjhq-5h92","tags":["vendor-advisory","Mitigation","Vendor Advisory","advisory","web"]},{"url":"https://www.vulncheck.com/advisories/openssl-encrypt-before-schema-validation-bypass","tags":["third-party-advisory","Third Party Advisory","advisory"]},{"url":"https://github.com/jahlives/openssl_encrypt/commit/6e7f938dcb7928faf5fd12bb5559f6dae2944124","tags":["web"]},{"url":"https://github.com/advisories/GHSA-425g-fjhq-5h92"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74875","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-m3pp-5f32-32h9"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74875.json","tags":["advisory"]},{"url":"https://github.com/jahlives/openssl_encrypt","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-74875","title":"openssl_encrypt before 1.4.0 Schema Validation Bypass","description":"openssl_encrypt versions before 1.4.0 silently skip JSON schema validation when the jsonschema library is not installed, allowing malformed metadata to be accepted. Attackers can remove the jsonschema package or supply unknown metadata format versions to bypass all schema checks and process malicious data.","status":"published","published":"2026-08-17T11:04:43.579Z","modified":"2026-10-08T15:24:49.333Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical","assessor":"cna"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-345"],"updated_at":"2026-11-02T14:20:03.081354Z"}],"euvd":[{"id":"EUVD-2026-60094","description":"openssl_encrypt versions before 1.4.0 silently skip JSON schema validation when the jsonschema library is not installed, allowing malformed metadata to be accepted. Attackers can remove the jsonschema package or supply unknown metadata format versions to bypass all schema checks and process malicious data.","status":"published","published":"2026-08-17T11:04:43Z","modified":"2026-10-08T15:24:49Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"updated_at":"2026-11-02T17:27:31.218078Z"}],"ghsa":[{"id":"GHSA-425g-fjhq-5h92","title":"openssl-encrypt silently skips schema validation when jsonschema library is not installed","description":"### Summary\n\nIn `openssl_encrypt/modules/json_validator.py` at **lines 234-238**, when the `jsonschema` library is not installed, all schema validation is silently skipped with only a print warning.\n\n### Affected Code\n\n```python\nif not JSONSCHEMA_AVAILABLE:\n    print(f\"Warning: Cannot validate against schema '{schema_name}' - jsonschema library not available\")\n    return\n```\n\nAdditionally, unknown metadata format versions (line 288-293) bypass schema validation entirely, and all schemas use `additionalProperties: true` allowing arbitrary extra fields.\n\n### Impact\n\nAn attacker who can influence the Python environment (remove the jsonschema package) or craft metadata with an unknown version number can bypass all schema checks. Malformed or malicious metadata will be accepted without validation.\n\n### Recommended Fix\n\n- Make `jsonschema` a required dependency, not optional\n- Or fail-closed: refuse to process metadata when validation cannot be performed\n- Reject unknown format versions instead of silently skipping validation\n- Consider using `additionalProperties: false` in schemas\n\n### Fix\n\nFixed in commit `6e7f938` on branch `releases/1.4.x` — validate_against_schema() now raises JSONValidationError when jsonschema is unavailable instead of silently passing; changed print() warning to logging.warning().","status":"published","published":"2026-03-31T23:43:33Z","modified":"2026-03-31T23:43:33Z","cvss":[{"version":"4.0","score":6.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U","level":"medium"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:39:47.075804Z"},{"id":"GHSA-m3pp-5f32-32h9","title":"openssl_encrypt versions before 1.4.0 silently skip JSON schema validation when the jsonschema...","description":"openssl_encrypt versions before 1.4.0 silently skip JSON schema validation when the jsonschema library is not installed, allowing malformed metadata to be accepted. Attackers can remove the jsonschema package or supply unknown metadata format versions to bypass all schema checks and process malicious data.","status":"published","published":"2026-08-17T12:32:22Z","modified":"2026-08-17T12:32:26Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-345"],"updated_at":"2026-11-02T15:10:34.0369Z"}],"nvd":[{"id":"CVE-2026-74875","description":"openssl_encrypt versions before 1.4.0 silently skip JSON schema validation when the jsonschema library is not installed, allowing malformed metadata to be accepted. Attackers can remove the jsonschema package or supply unknown metadata format versions to bypass all schema checks and process malicious data.","status":"published","published":"2026-08-17T11:16:41.943Z","modified":"2026-10-08T16:17:39.26Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-345"],"updated_at":"2026-11-02T14:12:38.647684Z"}],"osv":[{"id":"CVE-2026-74875","title":"openssl_encrypt before 1.4.0 Schema Validation Bypass","description":"openssl_encrypt versions before 1.4.0 silently skip JSON schema validation when the jsonschema library is not installed, allowing malformed metadata to be accepted. Attackers can remove the jsonschema package or supply unknown metadata format versions to bypass all schema checks and process malicious data.","status":"published","published":"2026-08-17T11:04:43.579Z","modified":"2026-10-28T02:30:42.2550331Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-345"],"updated_at":"2026-11-02T15:45:16.748692Z"},{"id":"GHSA-425g-fjhq-5h92","title":"openssl-encrypt silently skips schema validation when jsonschema library is not installed","description":"### Summary\n\nIn `openssl_encrypt/modules/json_validator.py` at **lines 234-238**, when the `jsonschema` library is not installed, all schema validation is silently skipped with only a print warning.\n\n### Affected Code\n\n```python\nif not JSONSCHEMA_AVAILABLE:\n    print(f\"Warning: Cannot validate against schema '{schema_name}' - jsonschema library not available\")\n    return\n```\n\nAdditionally, unknown metadata format versions (line 288-293) bypass schema validation entirely, and all schemas use `additionalProperties: true` allowing arbitrary extra fields.\n\n### Impact\n\nAn attacker who can influence the Python environment (remove the jsonschema package) or craft metadata with an unknown version number can bypass all schema checks. Malformed or malicious metadata will be accepted without validation.\n\n### Recommended Fix\n\n- Make `jsonschema` a required dependency, not optional\n- Or fail-closed: refuse to process metadata when validation cannot be performed\n- Reject unknown format versions instead of silently skipping validation\n- Consider using `additionalProperties: false` in schemas\n\n### Fix\n\nFixed in commit `6e7f938` on branch `releases/1.4.x` — validate_against_schema() now raises JSONValidationError when jsonschema is unavailable instead of silently passing; changed print() warning to logging.warning().","status":"published","published":"2026-03-31T23:43:33Z","modified":"2026-09-02T09:10:24.971029228Z","cvss":[{"version":"4.0","score":6.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U","level":"medium"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:46:36.434231Z"},{"id":"PYSEC-2026-3755","description":"openssl_encrypt versions before 1.4.0 silently skip JSON schema validation when the jsonschema library is not installed, allowing malformed metadata to be accepted. Attackers can remove the jsonschema package or supply unknown metadata format versions to bypass all schema checks and process malicious data.","status":"published","published":"2026-08-17T11:16:41.943Z","modified":"2026-09-02T09:00:03.093743722Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical"}],"updated_at":"2026-11-02T15:52:57.255153Z"}]}}