CVE-2026-74900

Name of the Vulnerable Software and Affected Versions openssl encrypt versions prior to 1.4.0

Description A critical issue exists in pqc.py where Key Encapsulation Mechanism (KEM) decapsulation failures silently revert to a simulation mode. In this mode, a deterministic shared secret is generated using only 16 bytes of the private key and publicly available encapsulated key data. Because the fallback occurs without raising an error, an attacker who obtains 16 bytes of the private key can compute the shared secret and decrypt all ciphertext.

Recommendations Update openssl encrypt to version 1.4.0 or later.