---
id: CVE-2026-81721
title: openssl_encrypt before 1.4.9 Denial of Service via KDF
summary: >-
  openssl_encrypt before 1.4.9 fails to validate KDF cost parameters in
  encrypted file metadata and keystore headers, allowing attackers to trigger
  unbounded memory allocation. Attackers can craft malicious encrypted files
  declaring arbitr…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-400
vendor: jahlives
product: openssl_encrypt
affected:
  - openssl_encrypt < 1.4.9
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-08-27T19:28:40.770457Z'
published: '2026-08-27'
updated: '2026-10-01'
sourceUpdated: '2026-10-01T15:21:39.545Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-81721'
references:
  - url: >-
      https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-7894-5gw8-69hr
    label: GitHub Security Advisory (GHSA-7894-5gw8-69hr)
  - url: >-
      https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-denial-of-service-via-kdf-2
    label: 'VulnCheck Advisory: openssl_encrypt before 1.4.9 Denial of Service via KDF'
tags:
  - cve.org
  - osv
  - pip
epss: 0.00581
epssPercentile: 0.47567
aliases:
  - PYSEC-2026-3803
  - GHSA-7894-5gw8-69hr
ecosystem: pip
patched:
  - openssl-encrypt 1.4.9
ingestedAt: '2026-09-03T19:32:12.490Z'
---

## Overview

openssl_encrypt before 1.4.9 fails to validate KDF cost parameters in encrypted file metadata and keystore headers, allowing attackers to trigger unbounded memory allocation. Attackers can craft malicious encrypted files declaring arbitrarily large Argon2, scrypt, or balloon KDF parameters to exhaust system memory and crash the process without authentication.

## Affected

- `openssl_encrypt < 1.4.9`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-81721)

Affected packages:

- `openssl-encrypt < 1.4.9`

Patched in:

- `openssl-encrypt 1.4.9`

Source: https://osv.dev/vulnerability/PYSEC-2026-3803