Resource exhaustion in Jahlives OpenSSL Encrypt
CVE-2026-81699
openssl_encrypt versions before 1.4.9 fail to properly validate key derivation function costs in crafted files, allowing attackers to trigger unbounded memory and CPU exhaustion during pre-authentication processing. Attackers can supply malicious files with excessive KDF parameters to exhaust system resources and crash or wedge the process before password verification occurs.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
Affected products
Weakness classification (CWE)
References
- disclosure@vulncheck.com (vendor-advisory)
- disclosure@vulncheck.com (third-party-advisory)
Frequently asked questions
- What is CVE-2026-81699?
- CVE-2026-81699 is a high-severity vulnerability in Jahlives OpenSSL Encrypt, classified under Allocation of Resources Without Limits or Throttling. CVSS score: 7.5/10. Published 2026-08-27.
- How severe is CVE-2026-81699?
- High severity. CVSS v3 base score is 7.5 out of 10.