CVE-2026-81720 — openssl_encrypt before 1.4.9 Denial of Service via Unbounded Argon2
openssl_encrypt before 1.4.9 fails to validate the memory_cost parameter from identity file protection blocks, allowing attackers to trigger out-of-memory conditions during key …
Published: 2026-08-27 · CVSS: 6.9 · CVSS 4.0
openssl_encrypt before 1.4.9 fails to validate the memory_cost parameter from identity file protection blocks, allowing attackers to trigger out-of-memory conditions during key derivation. Attackers with write access to local identity stores can craft malicious identity files with excessive memory_cost values that cause the host to crash when unlocking identities before authentication.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7