Vulnerability Description
openssl_encrypt versions before 1.4.9 contain a weak key derivation vulnerability in the D-Bus CryptoService.EncryptFile handler that uses unstretched SHA-256 instead of Argon2id. Attackers can perform offline password guessing against encrypted files roughly six to seven orders of magnitude faster than documented protection by exploiting the missing key stretching and hash rounds.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Jahlives | Openssl Encrypt | < 1.4.9 |
Related Weaknesses (CWE)
References
- https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-v9r6-grch-fVendor Advisory
- https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-weak-key-derivThird Party Advisory
FAQ
What is CVE-2026-81704?
CVE-2026-81704 is a vulnerability with a CVSS score of 7.5 (HIGH). openssl_encrypt versions before 1.4.9 contain a weak key derivation vulnerability in the D-Bus CryptoService.EncryptFile handler that uses unstretched SHA-256 instead of Argon2id. Attackers can perfor...
How severe is CVE-2026-81704?
CVE-2026-81704 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-81704?
Check the references section above for vendor advisories and patch information. Affected products include: Jahlives Openssl Encrypt.