This vulnerability affects jahlives' openssl_encrypt versions prior to 1.4.0. The restore_hidden_modules() function contains a logging flaw where it logs module counts after clearing, always showing zero restored modules, which corrupts audit trails and may hinder forensic analysis. Furthermore, a race condition exists between module hiding and import hook installation, allowing another thread to re-import modules that were intended to be blocked in multi-threaded environments. The CVSS 4.0 score is 9.3, indicating critical severity with network attack vector, low attack complexity, no privileges or user interaction required, and high impacts on confidentiality, integrity, and availability.

The improper logging corrupts audit trails, potentially impairing incident response and forensic investigations. The race condition can allow blocked modules to be re-imported, potentially bypassing security controls related to module hiding in multi-threaded applications. This could lead to unauthorized code execution or information disclosure depending on the modules involved.

A fix is available in jahlives openssl_encrypt version 1.4.0 and later. Users should upgrade to version 1.4.0 or above to remediate this vulnerability. No additional mitigations are specified.