CVE-2026-81687: Uncontrolled Resource Consumption in jahlives openssl_encrypt

The vulnerability in jahlives openssl_encrypt prior to version 1.4.9 involves the lack of enforcement of a time ceiling on KDF iteration counts specified in file metadata. This flaw permits attackers to create files with excessively high iteration counts, causing the software to consume CPU resources extensively during key derivation before password verification, resulting in potential denial of service through resource exhaustion.

Exploitation of this vulnerability can lead to denial of service conditions by exhausting CPU resources. Since the iteration count is unbounded, the system may become unresponsive or significantly degraded while processing maliciously crafted files. There is no indication of privilege escalation, data disclosure, or integrity compromise from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should monitor the vendor's official channels for updates or patches addressing this issue. Until a fix is available, consider restricting or validating input files to limit iteration counts if possible.