—

PYSEC-2026-3772

Quick fix

PYSEC-2026-3772 — openssl-encrypt: upgrade to the fixed version with the command below.

pip install --upgrade 'openssl-encrypt>=1.4.0'

Details

openssl_encrypt versions before 1.4.0 contain a critical vulnerability in pqc.py where KEM decapsulation failures silently fall back to simulation mode, generating a deterministic shared secret from only 16 bytes of the private key and publicly available encapsulated key data. Attackers who obtain 16 bytes of the private key can compute the shared secret and decrypt all ciphertext, as the fallback triggers on any KEM failure without raising an error.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/openssl-encrypt

Introduced in: 0Fixed in: 1.4.0

Fixpip install --upgrade 'openssl-encrypt>=1.4.0'

References

https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-p3gq-pcg9-qvfv[ADVISORY]
https://www.vulncheck.com/advisories/openssl-encrypt-before-weak-shared-secret-via-pqc-simulation-mode[ADVISORY]