CVE-2026-81686: Improper Input Validation in jahlives openssl_encrypt

The vulnerability in jahlives openssl_encrypt versions >=0 and <1.4.9 arises from improper input validation and missing authorization checks in the optional D-Bus crypto service's org.freedesktop.DBus.Properties.Set method. Local users can invoke this method without permission to set MaxConcurrentOperations to invalid values (0 or negative to block operations, or very large to remove limits) or set an unbounded DefaultTimeout. This manipulation leads to a persistent denial of service condition affecting the root daemon. The affected D-Bus service is exclusive to the 1.4.x line and was removed in 1.5.x, eliminating the vulnerability in later versions.

An unprivileged local user can cause a persistent denial of service to the root daemon by exploiting the lack of authorization and input validation in the D-Bus service. This can disrupt normal cryptographic operations by either preventing any concurrent operations or removing concurrency limits, potentially affecting system stability or functionality relying on the root daemon.

Upgrade to jahlives openssl_encrypt version 1.5.x or later, where the vulnerable D-Bus service has been removed. If upgrading is not immediately possible, restrict local user access to the system bus or disable the optional D-Bus crypto service to prevent unauthorized calls to the Set method. Patch status is not explicitly confirmed; check the vendor advisory for the latest remediation guidance.