Description

openssl_encrypt versions before 1.4.9 fail to enforce a time ceiling on key derivation function iteration counts specified in file metadata. Attackers can craft files with extremely high KDF iteration counts to consume CPU resources for unbounded periods before password verification occurs.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-08-27T17:20:58.410Z",
  "pubdate": "2026-08-27T17:20:58.410Z",
  "executiveSummary": "The openssl_encrypt library, in versions prior to 1.4.9, contains a critical Denial of Service (DoS) vulnerability arising from improper input validation regarding Key Derivation Function (KDF) iteration counts.\nThe vulnerability allows an unauthenticated attacker to supply a maliciously crafted file containing an excessively high KDF iteration count specified within the file's metadata.\nBecause the library fails to enforce a maximum time or iteration ceiling, the system is forced to allocate CPU resources to perform the computationally expensive KDF operations before verifying the password.\nThis creates an exploitation vector where an attacker can trigger unbounded CPU consumption, effectively rendering the application unresponsive or causing service exhaustion.\nThe impact is significant, as it requires minimal interaction—merely the processing of a crafted file—to initiate the resource exhaustion, potentially leading to widespread service degradation or system instability.",
  "technicalDetails": "The root cause of this vulnerability is the absence of a sanity check or upper bound constraint on the iteration count parameter used during key derivation within the openssl_encrypt functionality.\nKey Derivation Functions, typically utilized to transform passwords into cryptographic keys, involve a configurable number of iterations to increase the cost of brute-force attacks.\nIn the affected versions, the library blindly trusts the iteration count specified within the provided file's metadata.\nWhen the library processes a file, it attempts to derive the key using the parameters extracted directly from the file header. An attacker can craft a file with an iteration count set to a cryptographically astronomical value.\nUpon receiving such a file, the application invokes the vulnerable KDF function, which then enters a synchronous, CPU-intensive loop to satisfy the requested iteration count.\nThis process occurs prior to any actual password verification or integrity check. Consequently, the CPU remains trapped in the KDF computation for an unbounded duration, proportional to the malicious value provided.\nThis behavior facilitates a Denial of Service attack flow: 1. The attacker creates a file with a maximum permissible iteration count in the metadata. 2. The attacker delivers the file to the target system. 3. The target application attempts to read and decrypt/verify the file metadata. 4. The underlying openssl_encrypt library initiates the KDF routine based on the untrusted count. 5. The CPU resource is exhausted, causing the application to hang or become unresponsive to other legitimate requests.\nSince this processing happens before authentication or data integrity verification, there are no requirements for valid credentials, making it trivial for an attacker to trigger the condition.\nThe impact is localized to the server-side CPU resources, but in multi-threaded applications, multiple malicious requests can lead to full service saturation and complete denial of availability.\nThis issue affects all openssl_encrypt versions prior to 1.4.9."
}