CVE-2026-81687

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-81687
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-81687.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-81687
Aliases
  • GHSA-rv6w-7hq9-pr74
Published
2026-08-27T14:50:51.786Z
Modified
2026-09-02T03:30:37.105894568Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
openssl_encrypt before 1.4.9 Denial of Service via KDF
Details

openssl_encrypt versions before 1.4.9 fail to enforce a time ceiling on key derivation function iteration counts specified in file metadata. Attackers can craft files with extremely high KDF iteration counts to consume CPU resources for unbounded periods before password verification occurs.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81687.json",
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-400"
    ]
}
References

Affected packages

Git / github.com/jahlives/openssl_encrypt

Affected ranges

Type
GIT
Repo
https://github.com/jahlives/openssl_encrypt
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
39b0a010cae90520f74b7194f61fedd43af04ef8
Database specific
Show details 
{
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.4.9"
        }
    ]
}

Affected versions

v1.*
v1.4.0
v1.4.1rc1
v1.4.1rc2
v1.4.2
v1.4.4
v1.4.5
v1.4.6
v1.4.7

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-81687.json"