What is GHSA-fj6q-w4r8-75h7?

GHSA-fj6q-w4r8-75h7 is a security advisory published by GitHub Security Advisories with High severity. openssl_encrypt versions before 1.4.9 fail to enforce a time ceiling on key derivation function...

Which CVE IDs does GHSA-fj6q-w4r8-75h7 cover?

GHSA-fj6q-w4r8-75h7 covers the following CVE IDs: CVE-2026-81687. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-fj6q-w4r8-75h7?

GHSA-fj6q-w4r8-75h7 has a CVSS v3 base score of 5.5, published by GitHub Security Advisories.

GHSA-fj6q-w4r8-75h7HighCVSS 5.5

openssl_encrypt versions before 1.4.9 fail to enforce a time ceiling on key derivation function...

Vendor

GitHub Security Advisories

Published

August 27, 2026

Last Modified

August 27, 2026

🔗 CVE IDs covered (1)

CVE-2026-81687 →

📋 Description

openssl_encrypt versions before 1.4.9 fail to enforce a time ceiling on key derivation function iteration counts specified in file metadata. Attackers can craft files with extremely high KDF iteration counts to consume CPU resources for unbounded periods before password verification occurs.

🔗 References (4)

https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-rv6w-7hq9-pr74
https://nvd.nist.gov/vuln/detail/CVE-2026-81687
https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-denial-of-service-via-kdf
https://github.com/advisories/GHSA-fj6q-w4r8-75h7