CVE-2026-81720

opensslencrypt before 1.4.9 fails to validate the memorycost parameter from identity file protection blocks, allowing attackers to trigger out-of-memory conditions during key derivation. Attackers with write access to local identity stores can craft malicious identity files with excessive...

EUVD-2026-67070

opensslencrypt before 1.4.9 fails to validate the memorycost parameter from identity file protection blocks, allowing attackers to trigger out-of-memory conditions during key derivation. Attackers with write access to local identity stores can craft malicious identity files with excessive...

CVE-2026-81720

openssl_encrypt before 1.4.9 fails to validate the memory_cost parameter found in identity file protection blocks. Because the value is passed unboundedly into Argon2 key derivation, an attacker with write access to local identity stores can craft a malicious identity file with an excessive memor...