What is GHSA-723w-crw6-p9hx?

GHSA-723w-crw6-p9hx is a security advisory published by GitHub Security Advisories with Critical severity. openssl_encrypt versions before 1.4.0 contain a vulnerability in PublicKeyBundle.from_dict() that...

Which CVE IDs does GHSA-723w-crw6-p9hx cover?

GHSA-723w-crw6-p9hx covers the following CVE IDs: CVE-2026-74876. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-723w-crw6-p9hx?

GHSA-723w-crw6-p9hx has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

GHSA-723w-crw6-p9hxCriticalCVSS 9.8

openssl_encrypt versions before 1.4.0 contain a vulnerability in PublicKeyBundle.from_dict() that...

Vendor

GitHub Security Advisories

Published

August 17, 2026

Last Modified

August 17, 2026

🔗 CVE IDs covered (1)

CVE-2026-74876 →

📋 Description

openssl_encrypt versions before 1.4.0 contain a vulnerability in PublicKeyBundle.from_dict() that creates key bundles from untrusted data without verifying signatures. Attackers can call from_dict() followed by to_identity() without signature verification to encrypt data using attacker-controlled public keys, leaking secrets.

🔗 References (4)

https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-8h88-gxp3-j7pg
https://nvd.nist.gov/vuln/detail/CVE-2026-74876
https://www.vulncheck.com/advisories/openssl-encrypt-before-unverified-key-bundle-encryption
https://github.com/advisories/GHSA-723w-crw6-p9hx