CVE-2026-81720 - openssl_encrypt before 1.4.9 Denial of Service via Unbounded Argon2
Posted: Thu Aug 27, 2026 8:47 pm
CVE ID :CVE-2026-81720
Published : Aug. 27, 2026, 5:21 p.m. | 48 minutes ago
Description :openssl_encrypt before 1.4.9 fails to validate the memory_cost parameter from identity file protection blocks, allowing attackers to trigger out-of-memory conditions during key derivation. Attackers with write access to local identity stores can craft malicious identity files with excessive memory_cost values that cause the host to crash when unlocking identities before authentication.
Severity: 6.9 | MEDIUM
More Information:
https://cvefeed.io/vuln/detail/CVE-2026-81720
Published : Aug. 27, 2026, 5:21 p.m. | 48 minutes ago
Description :openssl_encrypt before 1.4.9 fails to validate the memory_cost parameter from identity file protection blocks, allowing attackers to trigger out-of-memory conditions during key derivation. Attackers with write access to local identity stores can craft malicious identity files with excessive memory_cost values that cause the host to crash when unlocking identities before authentication.
Severity: 6.9 | MEDIUM
More Information:
https://cvefeed.io/vuln/detail/CVE-2026-81720