Executive brief
openssl_encrypt is a Python library for file encryption that validates passwords using key derivation functions. Attackers can craft malicious files with excessive KDF parameters that consume unbounded memory and CPU before the password is even checked, causing the application to crash or hang and denying service to legitimate users.
Technical details
The vulnerability stems from multiple code paths that fail to properly estimate and enforce limits on key derivation costs during pre-authentication processing (CWE-770). Specific issues include: unmodeled parallelism in Balloon KDF leading to allocation of ~10^8 Future objects (F9); shadowed KDF config parameters in hash_config that bypass the estimator (F28); legacy version handling that hard-codes empty KDF config while the executor honors actual parameters (F29); and recovery path processing that runs full Argon2id unlocks for every slot before MAC validation (F16). An unauthenticated remote attacker can supply crafted files with extreme memory_cost values (e.g., 1 TiB for Argon2, 128 GiB for v3 legacy) to trigger OOM kills or process wedging before password verification. Version 1.4.9 and later implement hard caps on parallel costs, fold shadowed/legacy configs into cost estimation, and enforce per-slot memory ceilings during recovery.
Affected products
- jahlives openssl_encrypt before 1.4.9
Timeline
- 2026-08-27: disclosed
- 2026-08-27: patched: Version 1.4.9 released with fixes