CVE-2026-81721CWE-400denial-of-service

CVE-2026-81721

High · published August 27, 2026

CVSS v3.1

7.5

EPSS

Percentile

47.1

In the wild

Unconfirmed

What it is

openssl_encrypt before 1.4.9 fails to validate KDF cost parameters in encrypted file metadata and keystore headers, allowing attackers to trigger unbounded memory allocation. Attackers can craft malicious encrypted files declaring arbitrarily large Argon2, scrypt, or balloon KDF parameters to exhaust system memory and crash the process without authentication.

The record

Technical detail

CVSS v3.1: 7.5 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0: 8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS: 0.00581 · 47.1th percentile
Weakness: CWE-400 · Uncontrolled Resource Consumption
Published: 2026-08-27T21:21Z

Affected products (1)

Product	Versions	Fixed in
jahlives/openssl_encrypt	< 1.4.9	1.4.9

References (2)

https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-7894-5gw8-69hr · [email protected]https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-denial-of-service-via-kdf-2 · [email protected]

EPSS history

Timeline

27 AUG 14:51Z
openssl_encrypt before 1.4.9 Denial of Service via KDF
cvelistv5