← Vulnerability feed

Vulnerability record · CVE-2026-74878 · published 17 August 2026

CVE-2026-74878: Jahlives openssl encrypt allocation without limits vulnerability

JJahlives · Openssl Encrypt

openssl_encrypt versions before 1.4.0 use an in-memory rate limiter for TOTP brute-force protection that is not shared across workers and is lost on server restart. Attackers can distribute authentication attempts across multiple server instances or retry immediately after a restart to bypass rate limiting protections.

9.3 CVSS 4.0 Critical EPSS 0.75% · top 47.0% CWE-770 · Allocation without limits
9.3CVSS 4.0 base score
0.75%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
1 Sep 2026Last modified by NVD

Description

openssl_encrypt versions before 1.4.0 use an in-memory rate limiter for TOTP brute-force protection that is not shared across workers and is lost on server restart. Attackers can distribute authentication attempts across multiple server instances or retry immediately after a restart to bypass rate limiting protections.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-h45m-mgcp-q388 MitigationVendor Advisory
https://www.vulncheck.com/advisories/openssl-encrypt-before-totp-rate-limiter-bypass Third Party Advisory

Track CVE-2026-74878 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.3CVE-2026-81717Jahlives openssl encrypt improper verification of cryptographic signature vulnerabilityopenssl_encrypt (pip package openssl-encrypt) before 1.4.9 contains two weaknesses in the portable USB drive feature, whose threat model treats the r…EPSS 0.12%9.3CVE-2026-81719Jahlives openssl encrypt code injection vulnerabilityopenssl_encrypt before 1.4.9 executes untrusted third-party plugins with insufficient controls: the plugin signature policy defaulted to WARN, so an …EPSS 0.44%9.3CVE-2026-81706Jahlives openssl encrypt insufficient verification of data authenticity vulnerabilityopenssl_encrypt before 1.4.9 fails to prevent namespace collisions between own identities and contacts in IdentityStore, allowing attackers to create…EPSS 0.18%9.3CVE-2026-81714Jahlives openssl encrypt improper verification of cryptographic signature vulnerabilityopenssl_encrypt (pip: openssl-encrypt) versions <= 1.4.8 use suffix-tolerant fingerprint matching in enroll_trust_key when binding a plugin-signing t…EPSS 0.20%9.3CVE-2026-81698Jahlives openssl encrypt os command injection vulnerabilityopenssl_encrypt versions before 1.4.9 contain a shell injection vulnerability in the info command's reconstructed CLI block that interpolates untrust…EPSS 0.43%9.3CVE-2026-81700Jahlives openssl encrypt improper verification of cryptographic signature vulnerabilityopenssl_encrypt versions before 1.4.9 contain a signature verification vulnerability in gpg_runner.verify_detached that accepts revoked and expired k…EPSS 0.35%9.3CVE-2026-81701Jahlives openssl encrypt improper verification of cryptographic signature vulnerabilityopenssl_encrypt versions before 1.4.9 use a denylist to identify trusted built-in plugins, allowing unsigned plugins in top-level plugins/ directorie…EPSS 0.43%9.3CVE-2026-81702Jahlives openssl encrypt insufficient verification of data authenticity vulnerabilityopenssl_encrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities from identity.json, allowing attackers to substitut…EPSS 0.19%

Source: NIST National Vulnerability Database (record CVE-2026-74878), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.