---
cve: "CVE-2026-81687"
severity: "MEDIUM"
cvss: 5.5
epss: "2.7%"
vendor: "Generic Security"
kev: false
exploited: false
published: "2026-08-27 17:20:58"
tags: [cve, security, medium]
source: tsecurity.de CVE-Dossier
exported: "2026-09-03T03:21:35+02:00"
---

# CVE-2026-81687

> 5.5 MEDIUM

## Beschreibung

openssl_encrypt versions before 1.4.9 fail to enforce a time ceiling on key derivation function iteration counts specified in file metadata. Attackers can craft files with extremely high KDF iteration counts to consume CPU resources for unbounded periods before password verification occurs.

## CVSS-Vektor

```
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Lokal | good |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |
| UI Interaktion | Erforderlich | good |
| S Scope | Unverändert | good |
| C Vertraulichkeit | Keine | good |
| I Integrität | Keine | good |
| A Verfügbarkeit | Hoch | bad |

## Patch verfügbar (OSV)

- 39b0a010cae90520f74b7194f61fedd43af04ef8 (Commit)

## Referenzen

- <https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-rv6w-7hq9-pr74>
- <https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-denial-of-service-via-kdf>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-81687) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_