{"apiVersion":"1.0","identifier":"CVE-2026-74887","description":"openssl_encrypt before 1.4.0 imports Python-s non-cryptographic -random- module (Mersenne Twister PRNG) at line 15 of openssl_encrypt/modules/pqc.py. No direct calls to random.* were present in the code, so no cryptographic operation is currently affected; however, the import creates a hazard that future code could inadvertently use random.randint() instead of a cryptographically secure alternative (secrets/os.urandom), producing predictable values since the Mersenne Twister state can be recovered from approximately 624 outputs. Fixed by removing the import in 1.4.0.","publishedAt":"2026-08-17T11:16:43","lastModifiedAt":"2026-08-26T17:35:02","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-74887","cvssScore":0,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N","epssProbability":0.00207,"riskScore":0,"affectedProduct":"openssl_encrypt","affectedVersions":"<1.4.0","vulnerabilityType":"Library","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-74887","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-74887","en":"https://www.redsauce.net/en/cves/CVE-2026-74887","fr":"https://www.redsauce.net/fr/cves/CVE-2026-74887","pt":"https://www.redsauce.net/pt/cves/CVE-2026-74887","de":"https://www.redsauce.net/de/cves/CVE-2026-74887","sk":"https://www.redsauce.net/sk/cves/CVE-2026-74887","el":"https://www.redsauce.net/el/cves/CVE-2026-74887"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-74887"}}