CVE-2026-74875 — openssl_encrypt before 1.4.0 Schema Validation Bypass
openssl_encrypt versions before 1.4.0 silently skip JSON schema validation when the jsonschema library is not installed, allowing malformed metadata to be accepted. Attackers ca…
Published: 2026-08-17 · CVSS: 9.3 · CVSS 4.0
openssl_encrypt versions before 1.4.0 silently skip JSON schema validation when the jsonschema library is not installed, allowing malformed metadata to be accepted. Attackers can remove the jsonschema package or supply unknown metadata format versions to bypass all schema checks and process malicious data.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7