What is GHSA-ccp9-5g7c-pj86?

GHSA-ccp9-5g7c-pj86 is a security advisory published by GitHub Security Advisories with Critical severity. openssl_encrypt versions before 1.4.0 contain an arbitrary code execution vulnerability in the...

Which CVE IDs does GHSA-ccp9-5g7c-pj86 cover?

GHSA-ccp9-5g7c-pj86 covers the following CVE IDs: CVE-2026-74872. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-ccp9-5g7c-pj86?

GHSA-ccp9-5g7c-pj86 has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

GHSA-ccp9-5g7c-pj86CriticalCVSS 9.8

openssl_encrypt versions before 1.4.0 contain an arbitrary code execution vulnerability in the...

Vendor

GitHub Security Advisories

Published

August 17, 2026

Last Modified

August 17, 2026

🔗 CVE IDs covered (1)

CVE-2026-74872 →

📋 Description

openssl_encrypt versions before 1.4.0 contain an arbitrary code execution vulnerability in the Whirlpool hash implementation that uses broad glob patterns to load .so modules without integrity verification. Attackers can place malicious .so files matching the whirlpoolpy313.so pattern in site-packages directories to achieve native code execution when the module is loaded.

🔗 References (4)

https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-j48q-4c78-rhf9
https://nvd.nist.gov/vuln/detail/CVE-2026-74872
https://www.vulncheck.com/advisories/openssl-encrypt-before-arbitrary-code-execution-via-whirlpool
https://github.com/advisories/GHSA-ccp9-5g7c-pj86