CVE-2026-74876

Name of the Vulnerable Software and Affected Versions openssl encrypt versions prior to 1.4.0

Description A flaw exists in the PublicKeyBundle.from dict() function that allows the creation of key bundles from untrusted data without verifying signatures. An attacker can invoke from dict() and subsequently to identity() without signature verification to encrypt data using public keys under their control, which can lead to the leakage of secrets.

Recommendations Update openssl encrypt to version 1.4.0 or later. As a temporary mitigation, restrict the use of the PublicKeyBundle.from dict() function when handling untrusted data.