Vulnerability Description
openssl_encrypt before 1.4.9 fails to validate KDF cost parameters in encrypted file metadata and keystore headers, allowing attackers to trigger unbounded memory allocation. Attackers can craft malicious encrypted files declaring arbitrarily large Argon2, scrypt, or balloon KDF parameters to exhaust system memory and crash the process without authentication.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Jahlives | Openssl Encrypt | < 1.4.9 |
Related Weaknesses (CWE)
References
- https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-7894-5gw8-6Vendor Advisory
- https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-denial-of-servThird Party Advisory
FAQ
What is CVE-2026-81721?
CVE-2026-81721 is a vulnerability with a CVSS score of 7.5 (HIGH). openssl_encrypt before 1.4.9 fails to validate KDF cost parameters in encrypted file metadata and keystore headers, allowing attackers to trigger unbounded memory allocation. Attackers can craft malic...
How severe is CVE-2026-81721?
CVE-2026-81721 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-81721?
Check the references section above for vendor advisories and patch information. Affected products include: Jahlives Openssl Encrypt.