CVE-2026-81687CWE-400denial-of-service

CVE-2026-81687

Medium · published August 27, 2026

CVSS v3.1
5.5
EPSS
0%
Percentile
20.6
In the wild
Unconfirmed
What it is

openssl_encrypt versions before 1.4.9 fail to enforce a time ceiling on key derivation function iteration counts specified in file metadata. Attackers can craft files with extremely high KDF iteration counts to consume CPU resources for unbounded periods before password verification occurs.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00291 · 20.6th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2026-08-27T21:20Z
References (2)
https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-rv6w-7hq9-pr74 · [email protected]https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-denial-of-service-via-kdf · [email protected]
EPSS history
Timeline
  • 27 AUG 14:50Z
    openssl_encrypt before 1.4.9 Denial of Service via KDF
    cvelistv5