CVE-2026-81721

PYSEC-2026-3803 · CVE-2026-81721 · GHSA-7894-5gw8-69hr

Published Aug 27, 2026 · Modified Sep 3, 2026

AI SAST

Find this class of vulnerability in your own code

Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.

Explore AI SAST Explore dependency scanning →

Description

openssl_encrypt before 1.4.9 fails to validate KDF cost parameters in encrypted file metadata and keystore headers, allowing attackers to trigger unbounded memory allocation. Attackers can craft malicious encrypted files declaring arbitrarily large Argon2, scrypt, or balloon KDF parameters to exhaust system memory and crash the process without authentication.

References

ADVISORY https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-7894-5gw8-69hr
ADVISORY https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-denial-of-service-via-kdf-2

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes

CVE-2026-81721

Description

References

More PyPI vulnerabilities

Start Securing