What is GHSA-fxcp-mjj5-v58w?

GHSA-fxcp-mjj5-v58w is a security advisory published by GitHub Security Advisories with Critical severity. openssl_encrypt versions before 1.4.0 use HKDF with no salt and static info parameter in key...

Which CVE IDs does GHSA-fxcp-mjj5-v58w cover?

GHSA-fxcp-mjj5-v58w covers the following CVE IDs: CVE-2026-74889. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-fxcp-mjj5-v58w?

GHSA-fxcp-mjj5-v58w has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

GHSA-fxcp-mjj5-v58wCriticalCVSS 9.8

openssl_encrypt versions before 1.4.0 use HKDF with no salt and static info parameter in key...

Vendor

GitHub Security Advisories

Published

August 17, 2026

Last Modified

August 17, 2026

🔗 CVE IDs covered (1)

CVE-2026-74889 →

📋 Description

openssl_encrypt versions before 1.4.0 use HKDF with no salt and static info parameter in key normalization functions, reducing entropy extraction and determinism. Attackers can exploit predictable key derivation with identical inputs to weaken cryptographic security against multi-target attacks.

🔗 References (4)

https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-j9mh-57cc-665x
https://nvd.nist.gov/vuln/detail/CVE-2026-74889
https://www.vulncheck.com/advisories/openssl-encrypt-before-weak-key-derivation-via-hkdf
https://github.com/advisories/GHSA-fxcp-mjj5-v58w