CVE-2026-81721: Uncontrolled Resource Consumption in jahlives openssl_encrypt
Description
openssl_encrypt before 1.4.9 fails to validate KDF cost parameters in encrypted file metadata and keystore headers, allowing attackers to trigger unbounded memory allocation. Attackers can craft malicious encrypted files declaring arbitrarily large Argon2, scrypt, or balloon KDF parameters to exhaust system memory and crash the process without authentication.
CVSS v4.0
Score 8.7high
Affected software
jahlives
openssl_encrypt
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in jahlives openssl_encrypt versions prior to 1.4.9 stems from a failure to validate key derivation function (KDF) cost parameters in encrypted file metadata and keystore headers. Attackers can exploit this by creating encrypted files that specify excessively large Argon2, scrypt, or balloon KDF parameters, causing the software to allocate unbounded amounts of memory. This uncontrolled resource consumption can crash the process, resulting in denial of service. No authentication is required to trigger this behavior.
Potential Impact
Successful exploitation results in denial of service through memory exhaustion and process crashes. This can disrupt availability of services relying on the vulnerable openssl_encrypt component. There is no indication of data disclosure or privilege escalation from the provided information.
Mitigation Recommendations
A fix is available in jahlives openssl_encrypt version 1.4.9 and later. Users should upgrade to version 1.4.9 or newer to remediate this vulnerability. Patch status is confirmed by the affectedVersions field indicating versions before 1.4.9 are vulnerable.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-08-27T11:13:14.063Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a906bbbacd9273b4983a2f3
Added to database: 08/27/2026, 16:54:19 UTC
Last enriched: 10/02/2026, 15:57:22 UTC
Last updated: 10/09/2026, 18:48:23 UTC
Views: 94
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.