---
id: CVE-2026-81687
title: >-
  openssl_encrypt versions before 1.4.9 fail to enforce a time ceiling on key
  derivation function iteration counts specified in file metadata
summary: >-
  openssl_encrypt versions before 1.4.9 fail to enforce a time ceiling on key
  derivation function iteration counts specified in file metadata. Attackers can
  craft files with extremely high KDF iteration counts to consume CPU resources
  for …
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'
cwe:
  - CWE-400
published: '2026-08-27'
updated: '2026-09-23'
sourceUpdated: '2026-09-23T17:17:42.653'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-81687'
references:
  - url: >-
      https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-rv6w-7hq9-pr74
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-denial-of-service-via-kdf
    label: disclosure@vulncheck.com
tags:
  - nvd
epss: 0.00291
epssPercentile: 0.19355
ingestedAt: '2026-09-23T17:28:14.808Z'
---

## Overview

openssl_encrypt versions before 1.4.9 fail to enforce a time ceiling on key derivation function iteration counts specified in file metadata. Attackers can craft files with extremely high KDF iteration counts to consume CPU resources for unbounded periods before password verification occurs.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.