All intelligence
// vulnerability record
cached · NVD via COSMOS syncCVE-2026-74888
HIGHpublished 2026-08-17 11:16 UTC · 22 hours ago · modified 2026-08-17 13:16 UTC
8.7
CVSS / 10
// description
openssl_encrypt versions before 1.4.0 use a non-standard PBKDF2 key derivation construction with iterations=1 per call in an outer loop, creating a KDF whose security properties have not been formally analyzed. Attackers can exploit this weakened key derivation to more efficiently crack passwords protecting legacy encrypted files compared to standard PBKDF2 implementations.
// weaknesses (CWE)
- CWE-327