That 'critical' OpenSSL CVE isn't OpenSSL - it's a two-star Python package

A newly disclosed vulnerability rated critical, with a headline CVSS score of 9.8, sounds like the kind of thing that should make anyone running encryption software sit up. It should - but not for the reason the name suggests. CVE-2026-81707 doesn’t touch the OpenSSL library that underpins huge swathes of the internet. It affects openssl_encrypt, a much smaller Python package on PyPI that simply borrows a similar-sounding name.

What the bug actually does

According to the GitHub security advisory, the tool lets people import “identity” documents - bundles containing a name, an email address and a cryptographic fingerprint - so users can verify who they’re really talking to. The problem is that while the identity name was checked for dodgy input, the email field wasn’t. That field gets printed straight to the terminal, right above the all-important Fingerprint: line that users are supposed to compare out-of-band to confirm they’ve got the right key.

Because the email field is read from JSON, an attacker can smuggle in escaped ANSI terminal control codes (\u001b sequences) that Python’s JSON parser happily accepts, even though the built-in validator blocks literal control characters. Those codes can move the terminal cursor and overwrite the real fingerprint with a fake one of the attacker’s choosing. Since manual fingerprint comparison is, per the advisory, the only authenticity check this identity system offers, forging it defeats the entire point of the exercise.

VulnCheck’s write-up frames the realistic attack path: a malicious identity bundle sent through a normal contact-exchange flow or a compromised keyserver response, tricking a victim into trusting a substituted key while believing they’ve verified it properly.

So who is actually at risk

Anyone who has installed openssl_encrypt (the pip package from developer jahlives) at version 1.4.8 or earlier, and who relies on its identity-import feature to verify contacts’ keys. That’s it. This is not a flaw in OpenSSL itself, not a flaw in Python’s standard library, and not something that touches HTTPS, browsers or the wider encryption ecosystem that the name might imply. The GitHub repository shows a small user base - a handful of stars and a single fork - so the realistic blast radius looks modest, whatever the CVSS score implies about severity in isolation.

There’s no indication in the published advisories of the bug being exploited in the wild. This looks like responsible disclosure: the maintainer catalogued it, assigned a fix, and pushed version 1.4.9 before the CVE was even published.

What to do about it

If you or your organisation use openssl_encrypt specifically, the fix is straightforward: update to version 1.4.9 or later, where the email field is now sanitised before display. If you don’t recognise the package name, you’re not affected - this is not the OpenSSL project that secures a large share of the web’s traffic, and no update to system-level OpenSSL is required.

The takeaway

A 9.8 severity score grabs attention, but severity ratings describe how bad a flaw could be if exploited, not how many people it touches. Here, the fix already exists, there’s no sign of active abuse, and the affected tool has a small install base. Worth checking your dependencies if you use identity-verification tooling in Python - not worth losing sleep over otherwise.