Rate Limiting Bypass in OpenSSL Encrypt by Openssl

CVE-2026-74878

What is CVE-2026-74878?

OpenSSL Encrypt versions prior to 1.4.0 feature an in-memory rate limiter designed to protect against brute-force attacks on Time-based One-Time Passwords (TOTP). However, this rate limiter is not shared across multiple worker instances and is reset upon server restarts. This limitation allows attackers to distribute their authentication attempts across various server instances or to initiate attempts again immediately after a restart, effectively circumventing the rate limiting protections intended to enhance security.

References