Key Derivation Flaw in OpenSSL_Encrypt Affects Multiple Versions by OpenSSL

CVE-2026-74871

What is CVE-2026-74871?

OpenSSL_Encrypt versions prior to 1.4.6 are impacted by a significant key derivation flaw that affects the sequential XOR composition mode. The vulnerability arises because the last stage of key generation can inadvertently cancel out, leading to a memory-hard key derivation that becomes ineffective. When a single Key Derivation Function (KDF) is in use without a preceding hashing stage, this flaw allows attackers to bypass the designed memory-hardness, enabling them to conduct offline password cracking at speeds comparable to that of SHA-256, rather than adhering to the defined KDF cost.

References