CVE-2026-81721 jahlives CVE debrief

Who should care

Developers and administrators using openssl_encrypt in their applications, especially those handling encrypted files or keystore headers, should be aware of this vulnerability. Immediate action is recommended to upgrade to version 1.4.9 or later and implement necessary security measures to prevent potential DoS attacks.

Technical summary

The openssl_encrypt library before version 1.4.9 does not properly validate key derivation function (KDF) cost parameters in encrypted file metadata and keystore headers. This vulnerability allows attackers to craft malicious encrypted files with large KDF parameters (Argon2, scrypt, or balloon), which can cause unbounded memory allocation and lead to a denial-of-service (DoS) attack. The vulnerability has a CVSS score of 8.7 and is considered high severity.

Defensive priority

This vulnerability has a high CVSS score of 8.7 and is related to a denial-of-service (DoS) attack via KDF parameters. Immediate attention is required to ensure system stability and security.

Recommended defensive actions

• Inventory and assess systems using openssl_encrypt to identify potential vulnerabilities.
• Upgrade to version 1.4.9 or later of openssl_encrypt to fix the vulnerability.
• Implement monitoring to detect potential DoS attacks.
• Restrict access to sensitive encrypted files and keystore headers.
• Consider compensating controls such as rate limiting or IP blocking.

Evidence notes

The vulnerability exists in openssl_encrypt before version 1.4.9, where it fails to validate KDF cost parameters in encrypted file metadata and keystore headers. This allows attackers to trigger unbounded memory allocation by crafting malicious encrypted files with large Argon2, scrypt, or balloon KDF parameters, potentially leading to a denial-of-service (DoS) attack.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.