Medium severity5.5NVD Advisory· Published Aug 27, 2026

CVE-2026-81687

Description

openssl_encrypt versions before 1.4.9 fail to enforce a time ceiling on key derivation function iteration counts specified in file metadata. Attackers can craft files with extremely high KDF iteration counts to consume CPU resources for unbounded periods before password verification occurs.

Affected products

Jahlives/Openssl Encryptinferred2 versions
<1.4.9+ 1 more
- (no CPE)range: <1.4.9
- (no CPE)range: <1.4.9

Patches

Vulnerability mechanics

References

github.com/jahlives/openssl_encrypt/security/advisories/GHSA-rv6w-7hq9-pr74nvd
www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-denial-of-service-via-kdfnvd

News mentions

No linked articles in our index yet.

cvss	0.358
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000