CVE-2026-81699

openssl_encrypt versions before 1.4.9 fail to properly validate key derivation function (KDF) costs in crafted files. An attacker can supply a malicious file with excessive KDF parameters over the network with no privileges required , triggering unbounded memory and CPU exhaustion during pre-auth...

CVE-2026-81699 openssl_encrypt before 1.4.9 Denial of Service via unbounded KDF cost

opensslencrypt versions before 1.4.9 fail to properly validate key derivation function costs in crafted files, allowing attackers to trigger unbounded memory and CPU exhaustion during pre-authentication processing. Attackers can supply malicious files with excessive KDF parameters to exhaust syst...

CVE-2026-81699 openssl_encrypt before 1.4.9 Denial of Service via unbounded KDF cost

opensslencrypt versions before 1.4.9 fail to properly validate key derivation function costs in crafted files, allowing attackers to trigger unbounded memory and CPU exhaustion during pre-authentication processing. Attackers can supply malicious files with excessive KDF parameters to exhaust syst...

CVE-2026-81699

opensslencrypt versions before 1.4.9 fail to properly validate key derivation function costs in crafted files, allowing attackers to trigger unbounded memory and CPU exhaustion during pre-authentication processing. Attackers can supply malicious files with excessive KDF parameters to exhaust syst...

CVE-2026-81699 openssl_encrypt before 1.4.9 Denial of Service via unbounded KDF cost

opensslencrypt versions before 1.4.9 fail to properly validate key derivation function costs in crafted files, allowing attackers to trigger unbounded memory and CPU exhaustion during pre-authentication processing. Attackers can supply malicious files with excessive KDF parameters to exhaust syst...

CVE-2026-81697 openssl_encrypt before 1.4.9 KDF Downgrade via CWD-relative Configuration

opensslencrypt pip package openssl-encrypt versions = 1.4.8 contain a CWD-relative configuration file resolution flaw in cryptsettings.py, where CONFIGFILE originally the absolute per-user path /.cryptsettings.json is reassigned at line 84 to the bare relative name 'cryptsettings.json'. As a...

CVE-2026-81697

The openssl-encrypt PyPI package (versions ≤ 1.4.8) contains a CWD-relative configuration file resolution flaw in crypt_settings.py, where CONFIG_FILE—originally set to the absolute per-user path ~/.crypt_settings.json—is reassigned at line 84 to the bare relative name crypt_settings.json. The le...

EUVD-2026-67053

opensslencrypt pip package openssl-encrypt versions = 1.4.8 contain a CWD-relative configuration file resolution flaw in cryptsettings.py, where CONFIGFILE originally the absolute per-user path /.cryptsettings.json is reassigned at line 84 to the bare relative name 'cryptsettings.json'. As a...

CVE-2026-81697 openssl_encrypt before 1.4.9 KDF Downgrade via CWD-relative Configuration

opensslencrypt pip package openssl-encrypt versions = 1.4.8 contain a CWD-relative configuration file resolution flaw in cryptsettings.py, where CONFIGFILE originally the absolute per-user path /.cryptsettings.json is reassigned at line 84 to the bare relative name 'cryptsettings.json'. As a...

CVE-2026-81697 openssl_encrypt before 1.4.9 KDF Downgrade via CWD-relative Configuration

opensslencrypt pip package openssl-encrypt versions = 1.4.8 contain a CWD-relative configuration file resolution flaw in cryptsettings.py, where CONFIGFILE originally the absolute per-user path /.cryptsettings.json is reassigned at line 84 to the bare relative name 'cryptsettings.json'. As a...

EUVD-2026-67043

opensslencrypt versions before 1.4.9 fail to enforce a time ceiling on key derivation function iteration counts specified in file metadata. Attackers can craft files with extremely high KDF iteration counts to consume CPU resources for unbounded periods before password verification occurs...

CVE-2026-81687 openssl_encrypt before 1.4.9 Denial of Service via KDF

opensslencrypt versions before 1.4.9 fail to enforce a time ceiling on key derivation function iteration counts specified in file metadata. Attackers can craft files with extremely high KDF iteration counts to consume CPU resources for unbounded periods before password verification occurs...

CVE-2026-81687 openssl_encrypt before 1.4.9 Denial of Service via KDF

opensslencrypt versions before 1.4.9 fail to enforce a time ceiling on key derivation function iteration counts specified in file metadata. Attackers can craft files with extremely high KDF iteration counts to consume CPU resources for unbounded periods before password verification occurs...

CVE-2026-81687

opensslencrypt versions before 1.4.9 fail to enforce a time ceiling on key derivation function iteration counts specified in file metadata. Attackers can craft files with extremely high KDF iteration counts to consume CPU resources for unbounded periods before password verification occurs...

CVE-2026-81687

openssl_encrypt versions before 1.4.9 are vulnerable to a denial-of-service condition caused by the absence of a time ceiling on key derivation function (KDF) iteration counts embedded in file metadata. An attacker can craft a file with an extremely high iteration count, forcing the application t...

CVE-2026-81687 openssl_encrypt before 1.4.9 Denial of Service via KDF

opensslencrypt versions before 1.4.9 fail to enforce a time ceiling on key derivation function iteration counts specified in file metadata. Attackers can craft files with extremely high KDF iteration counts to consume CPU resources for unbounded periods before password verification occurs...

CVE-2026-13586

A flaw was found in Bouncy Castle for Java. This vulnerability allows a remote attacker to cause a Denial of Service DoS by exploiting an iteration-count bound issue in the PKCS12 Message Authentication Code MAC and bag-decryption Key Derivation Function KDF. This could make the affected system...

PT-2026-85196

openssl encrypt pip package openssl-encrypt before 1.4.9 contains two weaknesses in the portable USB drive feature, whose threat model treats the removable drive as untrusted attacker with physical write access. USBDriveCreator. verify integrity file only validates files listed in the manifest, s...

PT-2026-82600

Name of the Vulnerable Software and Affected Versions openssl encrypt versions prior to 1.4.9 Description Insufficient validation of key derivation function KDF costs in crafted files allows attackers to trigger unbounded memory and CPU exhaustion during pre-authentication processing. By supplyin...

PT-2026-82612

openssl encrypt pip package openssl-encrypt before 1.4.9 contains two weaknesses in the portable USB drive feature, whose threat model treats the removable drive as untrusted attacker with physical write access. USBDriveCreator. verify integrity file only validates files listed in the manifest, s...