CVE-2026-81699CWE-770denial-of-service

CVE-2026-81699

High · published August 27, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
42.2
In the wild
Unconfirmed
What it is

openssl_encrypt versions before 1.4.9 fail to properly validate key derivation function costs in crafted files, allowing attackers to trigger unbounded memory and CPU exhaustion during pre-authentication processing. Attackers can supply malicious files with excessive KDF parameters to exhaust system resources and crash or wedge the process before password verification occurs.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00505 · 42.2th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2026-08-27T21:21Z
Affected products (1)
ProductVersionsFixed in
jahlives/openssl_encrypt< 1.4.91.4.9
References (2)
https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-phmr-p567-q5g6 · [email protected]https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-denial-of-service-via-unbounded-kdf-cost · [email protected]
EPSS history
Timeline
  • 27 AUG 14:51Z
    openssl_encrypt before 1.4.9 Denial of Service via unbounded KDF cost
    cvelistv5