CVE-2026-81721

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-81721

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-81721.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-81721

Aliases

GHSA-7894-5gw8-69hr

Published

2026-08-27T14:51:15.109Z

Modified

2026-08-30T03:30:46.512557350Z

Severity

8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

openssl_encrypt before 1.4.9 Denial of Service via KDF

Details

openssl_encrypt before 1.4.9 fails to validate KDF cost parameters in encrypted file metadata and keystore headers, allowing attackers to trigger unbounded memory allocation. Attackers can craft malicious encrypted files declaring arbitrarily large Argon2, scrypt, or balloon KDF parameters to exhaust system memory and crash the process without authentication.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81721.json",
    "cwe_ids": [
        "CWE-400"
    ],
    "cna_assigner": "VulnCheck"
}

References

Affected packages

Git / github.com/jahlives/openssl_encrypt

Affected ranges

Type

GIT

Repo

https://github.com/jahlives/openssl_encrypt

Events

Introduced

Fixed

39b0a010cae90520f74b7194f61fedd43af04ef8

Database specific

Show details

{
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.4.9"
        }
    ]
}

Affected versions

v1.*

v1.4.0

v1.4.1rc1

v1.4.1rc2

v1.4.2

v1.4.4

v1.4.5

v1.4.6

v1.4.7

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-81721.json"