CVE-2026-81699: openssl_encrypt before 1.4.9 Denial of Service via unbounded KDF cost
opensslencrypt versions before 1.4.9 fail to properly validate key derivation function costs in crafted files, allowing attackers to trigger unbounded memory and CPU exhaustion during pre-authentication processing. Attackers can supply malicious files with excessive KDF parameters to exhaust system resources and crash or wedge the process before password verification occurs.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openssl_encryptto a version that resolves this vulnerability.Fixed in 1.4.9
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments using openssl_encrypt versions before 1.4.9 are affected if an attacker can provide crafted encrypted files for the application or process to handle.
Does exploitation require credentials or user interaction?
No. The supplied vector indicates network-reachable exploitation with no privileges or user interaction required, and the malicious KDF parameters are processed before password verification.
What is the likely impact of a successful attack?
An attacker can cause unbounded CPU and memory consumption, potentially crashing the affected process or leaving it wedged. The provided impact data indicates availability is affected, while confidentiality and integrity are not.