Description

openssl_encrypt versions before 1.4.9 fail to properly validate key derivation function costs in crafted files, allowing attackers to trigger unbounded memory and CPU exhaustion during pre-authentication processing. Attackers can supply malicious files with excessive KDF parameters to exhaust system resources and crash or wedge the process before password verification occurs.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-27T17:21:00.217Z",
  "pubdate": "2026-08-27T17:21:00.217Z",
  "executiveSummary": "The openssl_encrypt function, in versions prior to 1.4.9, is susceptible to a resource exhaustion vulnerability caused by insufficient validation of key derivation function (KDF) parameters within processed files.\nThe vulnerability allows an unauthenticated attacker to supply a crafted file containing excessive KDF cost parameters, which forces the system to allocate unbounded memory and consume disproportionate CPU cycles.\nThis behavior results in a Denial of Service (DoS) condition, effectively crashing the application or wedging the process prior to the password verification phase.\nThe impact is significant, as the attack occurs during pre-authentication processing, requiring no valid credentials or elevated privileges.\nThe primary risk implication is the potential for service unavailability and infrastructure instability when processing untrusted inputs.\nExploitation is straightforward, necessitating only the ability to supply a malicious file to the vulnerable component.",
  "technicalDetails": "The root cause of this vulnerability lies in the lack of input sanitization and boundary checking for KDF parameters within the openssl_encrypt function. KDFs, such as PBKDF2 or Argon2, rely on cost factors (e.g., iteration counts, memory usage limits) to mitigate brute-force attacks by increasing the computational effort required to derive a key.\nIn affected versions (pre-1.4.9), the implementation fails to enforce reasonable upper bounds on these cost factors before initiating the derivation process.\nWhen a malicious file containing artificially inflated KDF parameters is submitted, the openssl_encrypt function attempts to initialize the derivation routine using these provided values. Because the parameters are not validated, the function instructs the system to reserve excessive blocks of heap memory and initiate complex computational loops before any authentication or integrity checks are performed.\nThe attack flow follows a predictable sequence: First, the attacker provides a crafted file to the target application. Second, the vulnerable openssl_encrypt routine parses the malicious KDF parameters. Third, the application proceeds to execute the resource-intensive KDF, which triggers an uncontrolled allocation of memory or a prolonged CPU spin, depending on the specific cost parameters defined.\nBecause this occurs during the pre-authentication phase, the target process is rendered unresponsive or terminates due to resource starvation (e.g., Out-of-Memory killer invocation or thread starvation) before the system ever validates the credentials of the entity providing the input.\nThis vulnerability is particularly dangerous in network-exposed services where an attacker can remotely submit files, leading to remote, unauthenticated Denial of Service. The lack of prior authentication requirements means that any process calling the vulnerable openssl_encrypt function with untrusted input is a potential target, regardless of the security controls enforced later in the authentication pipeline."
}