CVE-2026-81699
HighCVSS 7.5Summary
openssl_encrypt before 1.4.9 fails to validate key derivation function costs in crafted files, allowing attackers to trigger unbounded memory and CPU exhaustion during pre-authentication processing. Malicious files with excessive KDF parameters can crash or wedge the process.
Risk Assessment
An attacker can cause denial of service or process hang, leading to system unavailability.
Recommendation
Upgrade openssl_encrypt to 1.4.9 or later, which properly validates KDF parameters.
Original NVD description (English source)
openssl_encrypt versions before 1.4.9 fail to properly validate key derivation function costs in crafted files, allowing attackers to trigger unbounded memory and CPU exhaustion during pre-authentication processing. Attackers can supply malicious files with excessive KDF parameters to exhaust system resources and crash or wedge the process before password verification occurs.