What is CVE-2026-74901?
The openSSL_encrypt library versions before 1.4.0 contain an authentication bypass vulnerability (CVE-2026-74901) in the pqc.py module. A failed AES-GCM decryption triggers a fallback to unauthenticated AES-CTR mode, allowing attackers to modify ciphertext in transit to bypass integrity verification and conduct bit-flipping attacks. Users should urgently upgrade to version 1.4.0 or later.
Azərbaycanca: openSSL_encrypt 1.4.0-dan əvvəlki versiyalarda pqc.py modulu vasitəsilə autentifikasiyadan yan keçmə zəifliyi (CVE-2026-74901) aşkarlanıb. AES-GCM deşifrə uğursuzluğu zamanı autentifikasiyasız AES-CTR rejiminə keçid edilir ki, bu da təcavüzkarlara şifrəli mətni dəyişərək bütövlük yoxlamasını keçməyə və bit-flipping hücumları həyata keçirməyə imkan verir. openSSL_encrypt istifadəçiləri dərhal 1.4.0 və ya daha yuxarı versiyaya yeniləməlidir.
Related CVEs
link basis: same weakness class CWE-287
FAQ2
How is the CVE-2026-74901 vulnerability exploited in openSSL_encrypt versions before 1.4.0?
The vulnerability occurs in the pqc.py module when a failed AES-GCM decryption falls back to unauthenticated AES-CTR mode. This allows attackers to modify ciphertext in transit, bypass integrity verification, and conduct bit-flipping attacks.
What action should be taken to mitigate the CVE-2026-74901 vulnerability?
Users of openSSL_encrypt should urgently upgrade to version 1.4.0 or later.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.