Skip to main content

openssl_encrypt CVE-2026-81699

| EUVDEUVD-2026-67055 HIGH
Allocation of Resources Without Limits or Throttling (CWE-770)
2026-08-27 VulnCheck GHSA-jpvp-h4hw-m539
Denial Of Service Openssl Encrypt
8.7
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.5 HIGH

Pure pre-auth DoS with no confidentiality or integrity impact; network-reachable and unauthenticated with no special conditions required.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
Patch available
Aug 27, 2026 - 18:02 EUVD
Analysis Generated
Aug 27, 2026 - 17:35 vuln.today
CVE Published
Aug 27, 2026 - 14:51 cve.org
HIGH 8.7

DescriptionCVE.org

openssl_encrypt versions before 1.4.9 fail to properly validate key derivation function costs in crafted files, allowing attackers to trigger unbounded memory and CPU exhaustion during pre-authentication processing. Attackers can supply malicious files with excessive KDF parameters to exhaust system resources and crash or wedge the process before password verification occurs.

AnalysisAI

Pre-authentication denial-of-service in jahlives/openssl_encrypt before 1.4.9 allows unauthenticated network attackers to exhaust server memory and CPU by supplying crafted files with arbitrarily large key derivation function cost parameters, crashing or permanently wedging the process before any password verification occurs. The attack requires no credentials and no user interaction, making it trivially automatable against any service that accepts attacker-supplied encrypted files as input. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Identify service accepting encrypted files pre-auth
Delivery
Craft file with extreme KDF cost parameters
Exploit
Submit file to intake endpoint unauthenticated
Execution
Library begins unbounded KDF computation
Persist
Memory and CPU exhausted
Impact
Server process crashes or becomes permanently unresponsive
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The target service must accept attacker-supplied encrypted files or data blobs for processing and pass them through the jahlives/openssl_encrypt library before authentication completes - exploitation occurs entirely at the pre-authentication stage. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 8.7 reflects network-reachable, unauthenticated, zero-interaction exploitation - signals that normally indicate high urgency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker submits a specially crafted encrypted file to any network-accessible endpoint backed by the jahlives/openssl_encrypt library. The file contains KDF parameters with extreme cost values (e.g., a scrypt N parameter of 2^30); the library begins key derivation pre-authentication, allocating gigabytes of memory and saturating CPU cores, ultimately crashing or permanently wedging the server process. …
Remediation Upgrade to openssl_encrypt version 1.4.9 or later, which introduces proper validation of KDF cost parameters; this is the vendor-confirmed fix per GitHub Security Advisory GHSA-phmr-p567-q5g6 at https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-phmr-p567-q5g6. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, inventory all internal services and third-party applications using jahlives/openssl_encrypt and assess exposure in production and pre-production environments; identify which services accept attacker-supplied encrypted files as input. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Openssl Encrypt

View all
CVE-2026-74872 CRITICAL
9.3 Aug 17

Arbitrary native code execution in the jahlives openssl_encrypt Python package (all versions before 1.4.0) arises from i
CVE-2026-74899 CRITICAL
9.3 Aug 17

Sandbox escape in the openssl_encrypt Python library (jahlives) before 1.4.0 lets attacker-supplied plugin code break ou
CVE-2026-74887 CRITICAL
9.3 Aug 17

Insecure PRNG import in the jahlives openssl_encrypt Python package (all versions before 1.4.0) places Python's non-cryp
CVE-2026-81719 CRITICAL
9.3 Aug 27

Arbitrary code execution in openssl_encrypt (the jahlives Python encryption utility) before 1.4.9 allows an attacker-sup
CVE-2026-81717 CRITICAL
9.3 Aug 27

Cryptographic integrity bypass and weak key derivation in the openssl-encrypt Python package (jahlives) before 1.4.9 let
CVE-2026-81714 CRITICAL
9.3 Aug 27

Signature-trust bypass in the openssl_encrypt Python library (PyPI 'openssl-encrypt') versions 1.4.8 and earlier lets an
CVE-2026-81707 CRITICAL
9.3 Aug 27

Fingerprint-verification spoofing in jahlives openssl_encrypt before 1.4.9 lets attackers embed ANSI escape sequences in
CVE-2026-81706 CRITICAL
9.3 Aug 27

Silent cryptographic key substitution in jahlives openssl_encrypt before 1.4.9 lets attackers register 'shadow' contact

CVE-2026-81702 CRITICAL
9.3 Aug 27

Silent cryptographic key substitution affects openssl_encrypt (the jahlives Python encryption library) before 1.4.9, whi
CVE-2026-81701 CRITICAL
9.3 Aug 27

Arbitrary code execution in jahlives openssl_encrypt before 1.4.9 stems from a flawed plugin trust model that uses a den
CVE-2026-81700 CRITICAL
9.3 Aug 27

Signature verification bypass in openssl_encrypt (the jahlives Python encryption library) before version 1.4.9 lets atta
CVE-2026-81698 CRITICAL
9.3 Aug 27

Arbitrary command execution in jahlives' openssl_encrypt before 1.4.9 arises when the tool's 'info' command reconstructs

Same weakness CWE-770 – Allocation of Resources Without Limits or Throttling

View all
CVE-2017-8779 HIGH POC
7.5
CVE-2025-53521 CRITICAL POC
9.3
CVE-2017-5850 HIGH POC
7.5
CVE-2025-26682 HIGH
7.5
CVE-2025-41770 HIGH
8.7
CVE-2025-26466 MEDIUM
5.9
CVE-2020-37067 CRITICAL POC
9.8
CVE-2021-47875 CRITICAL POC
9.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Share

CVE-2026-81699 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy