Description

openssl_encrypt before 1.4.9 fails to validate KDF cost parameters in encrypted file metadata and keystore headers, allowing attackers to trigger unbounded memory allocation. Attackers can craft malicious encrypted files declaring arbitrarily large Argon2, scrypt, or balloon KDF parameters to exhaust system memory and crash the process without authentication.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-27T17:21:02.650Z",
  "pubdate": "2026-08-27T17:21:02.650Z",
  "executiveSummary": "The openssl_encrypt library (prior to version 1.4.9) contains a critical security vulnerability related to improper input validation of Key Derivation Function (KDF) cost parameters.\nThe vulnerability allows an unauthenticated remote attacker to perform a Denial of Service (DoS) attack by crafting malicious encrypted files or keystore headers.\nBy specifying arbitrarily high values for memory-intensive algorithms such as Argon2, scrypt, or balloon, an attacker can force the application to perform unbounded memory allocation.\nThis leads to rapid exhaustion of system memory (RAM), triggering an out-of-memory (OOM) condition that forces the process to crash.\nBecause this validation failure occurs during the initial parsing of metadata, the attack does not require valid credentials or prior authentication.\nThe risk implication is high for services that process externally provided encrypted data, as it allows for trivial remote process termination without leaving significant traces in application logs.",
  "technicalDetails": "The root cause of the vulnerability lies in the insufficient sanitization and validation of KDF configuration parameters embedded within the metadata or keystore headers of encrypted files processed by openssl_encrypt.\nWhen the library parses these files, it extracts parameters intended to control the resource complexity of the KDF—specifically targeting algorithms like Argon2, scrypt, and balloon, which are designed to be memory-hard.\nThe implementation fails to enforce upper bounds or sanity checks on the cost factors, such as memory usage, iteration count, or parallelism, supplied by the file header.\nAn attacker can exploit this by crafting a file with a header claiming an extremely large memory requirement (e.g., specifying multi-gigabyte allocation requests).\nUpon processing, the library attempts to allocate the requested buffer size without validating whether the platform has sufficient available memory to honor the request.\nThe attack flow is as follows: 1) The attacker delivers a malicious file to the target application; 2) The library parses the KDF parameters; 3) The application executes the KDF initialization routine using the attacker-supplied parameters; 4) The system attempts to allocate the requested memory heap; 5) The process exhausts the available system memory, leading to an immediate crash due to an OOM killer event or a failure in the memory allocation call.\nSince this parsing occurs before the decryption process, authentication mechanisms are bypassed entirely. The vulnerability affects all versions of openssl_encrypt prior to 1.4.9.\nThe impact is a guaranteed service disruption (Denial of Service). Because the exhaustion happens at the allocator level, it can impact the stability of the entire host system if it triggers widespread thrashing or kernel-level memory reclamation processes."
}