CVE-2026-81699

Analyzed Analyzed - Analysis Complete

OpenSSL Memory Exhaustion via Excessive KDF Costs

Publication date: 2026-08-27

Last updated on: 2026-09-03

Assigner: VulnCheck

Description

openssl_encrypt versions before 1.4.9 fail to properly validate key derivation function costs in crafted files, allowing attackers to trigger unbounded memory and CPU exhaustion during pre-authentication processing. Attackers can supply malicious files with excessive KDF parameters to exhaust system resources and crash or wedge the process before password verification occurs.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-09-03

Generated

2026-09-17

AI Q&A

2026-08-27

EPSS Evaluated

2026-09-15

NVD

CVE-2026-81699

EUVD

EUVD-2026-67055

Affected Vendors & Products

Vendor	Product	Version / Range
jahlives	openssl_encrypt	to 1.4.9 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

This vulnerability affects openssl_encrypt versions before 1.4.9. It involves improper validation of key derivation function (KDF) costs in crafted files, allowing attackers to trigger unbounded memory and CPU exhaustion during pre-authentication processing. Attackers can supply malicious files with excessive KDF parameters to crash or hang the process before password verification.

Detection Guidance

To detect this vulnerability, check the installed version of openssl_encrypt using the command: openssl_encrypt --version. If the version is less than 1.4.9, the system is vulnerable. Additionally, monitor for unusual CPU or memory spikes during file processing, which may indicate exploitation attempts.

Impact Analysis

This vulnerability can lead to denial-of-service conditions, causing system crashes or process hangs before authentication. It may exhaust system resources like memory and CPU, disrupting services relying on openssl_encrypt for encryption tasks.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling denial-of-service attacks that disrupt system availability. GDPR requires ensuring data processing systems are resilient, while HIPAA mandates safeguards against unauthorized resource exhaustion. Exploits may violate availability requirements in these standards.

Mitigation Strategies

Immediately update openssl_encrypt to version 1.4.9 or later. If updating is not possible, restrict access to files processed by openssl_encrypt and implement resource limits to prevent excessive CPU or memory usage during file processing.

Hi! I’m here to help you understand CVE-2026-81699. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70