Skip to main content

openssl_encrypt CVE-2026-81687

| EUVDEUVD-2026-67043 HIGH
Uncontrolled Resource Consumption (CWE-400)
2026-08-27 VulnCheck GHSA-fj6q-w4r8-75h7
Denial Of Service Openssl Encrypt
8.7
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.5 HIGH

Network-reachable DoS via file submission; no privileges or interaction needed; impact is availability-only with no confidentiality or integrity consequence.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
Patch available
Aug 27, 2026 - 18:02 EUVD
Analysis Generated
Aug 27, 2026 - 17:42 vuln.today
CVE Published
Aug 27, 2026 - 14:50 cve.org
HIGH 8.7

DescriptionCVE.org

openssl_encrypt versions before 1.4.9 fail to enforce a time ceiling on key derivation function iteration counts specified in file metadata. Attackers can craft files with extremely high KDF iteration counts to consume CPU resources for unbounded periods before password verification occurs.

AnalysisAI

Unbounded KDF iteration processing in jahlives/openssl_encrypt before 1.4.9 allows remote unauthenticated attackers to trigger sustained CPU exhaustion by supplying crafted files whose metadata contains arbitrarily high key derivation function iteration counts. Because the library reads this attacker-controlled value from file metadata and begins key derivation without enforcing any upper time or iteration ceiling, authentication can be held hostage indefinitely, starving the host of CPU resources. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Submit crafted encrypted file via upload endpoint
Delivery
Library parses attacker-controlled KDF iteration count from file metadata
Exploit
Key derivation begins with no ceiling enforced
Execution
CPU thread fully consumed for arbitrarily long duration
Impact
Decryption thread unresponsive; service availability degraded
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The target application must use jahlives/openssl_encrypt before 1.4.9 and must expose an endpoint that accepts and attempts to decrypt or process attacker-supplied encrypted files without first sanitizing the KDF iteration count in the file's metadata. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The provided CVSS 4.0 score of 8.7 warrants scrutiny: the vector as supplied lists VC:H (high confidentiality impact) but the CVE description and CWE-400 tag describe a pure resource-exhaustion DoS with no data disclosure component. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker submits a crafted encrypted file to any publicly accessible endpoint - such as a file upload form or API - backed by an unpatched openssl_encrypt deployment. The metadata field controlling KDF iteration count is set to a value near the 64-bit integer maximum. …
Remediation Upgrade jahlives/openssl_encrypt to version 1.4.9 or later, which is the first release to enforce a time or iteration-count ceiling during KDF processing per the vendor security advisory at https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-rv6w-7hq9-pr74. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, conduct an urgent inventory of all systems running jahlives/openssl_encrypt prior to version 1.4.9 and identify which process untrusted encrypted file uploads; immediately restrict network access to affected authentication services to known internal IP ranges only and activate incident response protocols. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Openssl Encrypt

View all
CVE-2026-74872 CRITICAL
9.3 Aug 17

Arbitrary native code execution in the jahlives openssl_encrypt Python package (all versions before 1.4.0) arises from i
CVE-2026-74899 CRITICAL
9.3 Aug 17

Sandbox escape in the openssl_encrypt Python library (jahlives) before 1.4.0 lets attacker-supplied plugin code break ou
CVE-2026-74887 CRITICAL
9.3 Aug 17

Insecure PRNG import in the jahlives openssl_encrypt Python package (all versions before 1.4.0) places Python's non-cryp
CVE-2026-81719 CRITICAL
9.3 Aug 27

Arbitrary code execution in openssl_encrypt (the jahlives Python encryption utility) before 1.4.9 allows an attacker-sup
CVE-2026-81717 CRITICAL
9.3 Aug 27

Cryptographic integrity bypass and weak key derivation in the openssl-encrypt Python package (jahlives) before 1.4.9 let
CVE-2026-81714 CRITICAL
9.3 Aug 27

Signature-trust bypass in the openssl_encrypt Python library (PyPI 'openssl-encrypt') versions 1.4.8 and earlier lets an
CVE-2026-81707 CRITICAL
9.3 Aug 27

Fingerprint-verification spoofing in jahlives openssl_encrypt before 1.4.9 lets attackers embed ANSI escape sequences in
CVE-2026-81706 CRITICAL
9.3 Aug 27

Silent cryptographic key substitution in jahlives openssl_encrypt before 1.4.9 lets attackers register 'shadow' contact

CVE-2026-81702 CRITICAL
9.3 Aug 27

Silent cryptographic key substitution affects openssl_encrypt (the jahlives Python encryption library) before 1.4.9, whi
CVE-2026-81701 CRITICAL
9.3 Aug 27

Arbitrary code execution in jahlives openssl_encrypt before 1.4.9 stems from a flawed plugin trust model that uses a den
CVE-2026-81700 CRITICAL
9.3 Aug 27

Signature verification bypass in openssl_encrypt (the jahlives Python encryption library) before version 1.4.9 lets atta
CVE-2026-81698 CRITICAL
9.3 Aug 27

Arbitrary command execution in jahlives' openssl_encrypt before 1.4.9 arises when the tool's 'info' command reconstructs

Same weakness CWE-400 – Uncontrolled Resource Consumption

View all
CVE-2023-44487 HIGH POC
7.5
CVE-2026-45498 HIGH POC
7.5
CVE-2016-8610 HIGH
7.5
CVE-2026-28318 HIGH POC
7.5
CVE-2023-38180 HIGH
7.5
CVE-2025-26673 HIGH
7.5
CVE-2015-7978 HIGH
7.5
CVE-2025-27473 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Share

CVE-2026-81687 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy