CVE-2026-81687
MediumCVSS 5.5Summary
openssl_encrypt before version 1.4.9 fails to enforce a time ceiling on key derivation function iteration counts specified in file metadata. Attackers can craft files with extremely high KDF iteration counts to consume CPU resources for unbounded periods before password verification occurs.
Risk Assessment
The risk is a potential denial-of-service attack on servers or workstations processing malicious files, leading to service unavailability.
Recommendation
Immediately upgrade openssl_encrypt to version 1.4.9 or later, which introduces a time limit for KDF iterations.
Original NVD description (English source)
openssl_encrypt versions before 1.4.9 fail to enforce a time ceiling on key derivation function iteration counts specified in file metadata. Attackers can craft files with extremely high KDF iteration counts to consume CPU resources for unbounded periods before password verification occurs.