CVE-2026-81688: openssl_encrypt before 1.4.9 Plaintext Confirmation Oracle via SHA-256
opensslencrypt versions before 1.4.9 store an unkeyed SHA-256 hash of the plaintext in the cleartext file header metadata. Attackers can read this hash without the password to confirm guessed plaintexts offline or fingerprint identical plaintexts across separately-encrypted files.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openssl_encryptto a version that resolves this vulnerability.Fixed in 1.4.9 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch Plaintext Confirmation Oracle via SHA-256
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of openssl_encrypt versions before 1.4.9 are exposed for encrypted files whose headers can be read by an attacker. The attacker does not need the password to obtain the stored SHA-256 value.
What can an attacker do with the header hash?
An attacker can hash plaintext guesses offline and compare them with the unkeyed SHA-256 hash in the file header to confirm a guess. They can also identify identical plaintexts across separately encrypted files.
Does exploitation require credentials or user interaction?
No. Exploitation only requires access to the encrypted file header metadata; the password is not required, and no user interaction is needed.