Non-Standard PBKDF2 Key Derivation Issue in OpenSSL Encrypt by GitHub

CVE-2026-74888

What is CVE-2026-74888?

The openssl_encrypt library, prior to version 1.4.0, employs a non-standard PBKDF2 key derivation method that uses only a single iteration per call within an outer loop. This poor implementation compromises the security of the key derivation function, making it significantly easier for attackers to crack passwords that protect older encrypted files. Unlike standard PBKDF2 configurations, this setup has not undergone formal security analysis, leaving crucial vulnerabilities open to exploitation. Organizations using affected versions must consider updates to ensure enhanced protection against unauthorized access.

References