High severity7.5NVD Advisory· Published Aug 27, 2026· Updated Sep 2, 2026
CVE-2026-81721
CVE-2026-81721
Description
openssl_encrypt before 1.4.9 fails to validate KDF cost parameters in encrypted file metadata and keystore headers, allowing attackers to trigger unbounded memory allocation. Attackers can craft malicious encrypted files declaring arbitrarily large Argon2, scrypt, or balloon KDF parameters to exhaust system memory and crash the process without authentication.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2<1.4.9+ 1 more
- (no CPE)range: <1.4.9
- (no CPE)range: <1.4.9
Patches
Vulnerability mechanics
References
2- github.com/jahlives/openssl_encrypt/security/advisories/GHSA-7894-5gw8-69hrnvdVendor Advisory
- www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-denial-of-service-via-kdf-2nvdThird Party Advisory
News mentions
1- Jahlives Openssl Encrypt: 25 Vulnerabilities Disclosed in Single Batch, Patched in 1.4.9Vypr Intelligence · Aug 27, 2026