CVE-2026-74887

Name of the Vulnerable Software and Affected Versions openssl encrypt versions prior to 1.4.0

Description The software imports Python's non-cryptographic random module, which uses a Mersenne Twister Pseudo-Random Number Generator (PRNG), within the openssl encrypt/modules/pqc.py file. While no cryptographic operations are currently affected, the presence of this import creates a risk that future development might use random.randint() instead of cryptographically secure alternatives like secrets or os.urandom. This could lead to predictable values because the state of the Mersenne Twister can be recovered after observing approximately 624 outputs.

Recommendations Update to version 1.4.0.