Description

openssl_encrypt versions before 1.4.0 silently skip JSON schema validation when the jsonschema library is not installed, allowing malformed metadata to be accepted. Attackers can remove the jsonschema package or supply unknown metadata format versions to bypass all schema checks and process malicious data.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-17T11:16:41.943Z",
  "pubdate": "2026-08-17T11:16:41.943Z",
  "executiveSummary": "A missing dependency validation vulnerability exists in openssl_encrypt versions before 1.4.0.\nThe vulnerability involves improper validation and soft-dependency handling, specifically related to the silent bypassing of JSON schema validation when the optional jsonschema library is absent.\nThe primary impact is the acceptance of malformed and untrusted metadata, potentially leading to the processing of malicious data.\nAffected systems are those running openssl_encrypt prior to version 1.4.0 where the environment lacks the jsonschema dependency.\nThe risk implication is significant as it undermines data integrity guarantees and core security controls through input validation bypass.\nAttackers with the capability to manipulate the execution environment by removing the jsonschema package, or those who can supply custom metadata format versions, are positioned to exploit this flaw.\nNo complex exploitation requirements are stated beyond environment manipulation or supplying crafted metadata designed to evade absent checks.",
  "technicalDetails": "The root cause of this vulnerability lies in the defensive programming logic within the openssl_encrypt codebase prior to version 1.4.0.\nSpecifically, the application relies on an optional external dependency, the jsonschema library, to enforce structural and format constraints on incoming metadata payloads.\nWhen the jsonschema library is missing from the runtime environment, the application fails to enforce a fail-secure posture.\nInstead of raising a fatal runtime exception, halting execution, or rejecting the payload outright, the validation routine silently skips the JSON schema validation phase entirely.\nThe vulnerable component is the metadata verification subsystem within openssl_encrypt versions before 1.4.0.\nThe exploitation method leverages this insecure soft-dependency design pattern.\nAn attacker can execute an attack flow by first ensuring that the jsonschema package is uninstalled or absent from the target execution environment, or by supplying unknown and unhandled metadata format versions that the fallback logic fails to process securely.\nBecause the validation check is silently bypassed, the application proceeds to accept arbitrarily structured, malformed, or malicious metadata as valid.\nThe payload behavior involves passing unchecked data structures deeper into the application logic, where subsequent processing of malformed metadata can lead to unpredictable application states or further downstream exploitation.\nThe vulnerability does not inherently require authentication or specific privilege levels beyond the ability to influence the runtime environment or supply the target metadata payload processed by openssl_encrypt."
}