CVE-2026-74885 — openssl_encrypt before 1.4.0 Logging Bug and Race Condition
openssl_encrypt versions before 1.4.0 contain a logging bug in restore_hidden_modules() that logs module counts after clearing, always showing zero restored modules and corrupti…
Published: 2026-08-17 · CVSS: 9.3 · CVSS 4.0
openssl_encrypt versions before 1.4.0 contain a logging bug in restore_hidden_modules() that logs module counts after clearing, always showing zero restored modules and corrupting audit trails. Additionally, a race condition exists between module hiding and import hook installation where another thread could re-import blocked modules in multi-threaded environments.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7