—
PYSEC-2026-3779
Quick fix
PYSEC-2026-3779 — openssl-encrypt: upgrade to the fixed version with the command below.
pip install --upgrade 'openssl-encrypt>=1.4.9'Details
openssl_encrypt versions before 1.4.9 fail to validate encryption status of embedded post-quantum private keys in file metadata. Attackers can craft files with unencrypted embedded PQC keys that decrypt under any password, bypassing authentication and producing attacker-chosen plaintext with false integrity verification.
Are you affected?
Enter the version of the package you're using.
Affected packages
PyPI/openssl-encrypt
Introduced in:
0Fixed in: 1.4.9Fix
pip install --upgrade 'openssl-encrypt>=1.4.9'