CVE-2026-81699

EUVD-2026-67055
openssl_encrypt versions before 1.4.9 fail to properly validate key derivation function costs in crafted files, allowing attackers to trigger unbounded memory and CPU exhaustion during pre-authentication processing. Attackers can supply malicious files with excessive KDF parameters to exhaust system resources and crash or wedge the process before password verification occurs.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 41.36%
Affected Products (NVD)
VendorProductVersion
jahlivesopenssl_encrypt
𝑥
< 1.4.9
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-phmr-p567-q5g6
https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-denial-of-service-via-unbounded-kdf-cost