Is CVE-2026-81699 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-81699 being exploited in the wild.

How severe is CVE-2026-81699?

High severity, with a CVSS score of 7.5, published 27 August 2026.

Which products and versions are affected?

Jahlives Openssl Encrypt before 1.4.9; openssl-encrypt (PyPI) ECOSYSTEM:introduced=0,fixed=1.4.9.

Is there a fix for CVE-2026-81699?

Yes. openssl-encrypt (PyPI): upgrade to 1.4.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-81699 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-81699?

Check whether you run Jahlives Openssl Encrypt or openssl-encrypt (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-81699: openssl_encrypt unbounded KDF cost denial of service

CVE-2026-81699 · Severity: high · CVSS 7.5 · Published 2026-08-27

openssl_encrypt is a Python library for file encryption that validates passwords using key derivation functions. Attackers can craft malicious files with excessive KDF parameters that consume unbounded memory and CPU before the password is even checked, causing the application to crash or hang and denying service to legitimate users.

Technologies: Jahlives Openssl Encrypt, openssl-encrypt (PyPI). Vendors: Jahlives, PyPI.

Quick answers

Is CVE-2026-81699 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-81699 being exploited in the wild.
How severe is CVE-2026-81699?: High severity, with a CVSS score of 7.5, published 27 August 2026.
Which products and versions are affected?: Jahlives Openssl Encrypt before 1.4.9; openssl-encrypt (PyPI) ECOSYSTEM:introduced=0,fixed=1.4.9.
Is there a fix for CVE-2026-81699?: Yes. openssl-encrypt (PyPI): upgrade to 1.4.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-81699 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-81699?: Check whether you run Jahlives Openssl Encrypt or openssl-encrypt (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

openssl-encrypt (PyPI): upgrade to 1.4.9 or later
```
pip install "openssl-encrypt>=1.4.9"
```

Technical details

The vulnerability stems from multiple code paths that fail to properly estimate and enforce limits on key derivation costs during pre-authentication processing (CWE-770). Specific issues include: unmodeled parallelism in Balloon KDF leading to allocation of ~10^8 Future objects (F9); shadowed KDF config parameters in hash_config that bypass the estimator (F28); legacy version handling that hard-codes empty KDF config while the executor honors actual parameters (F29); and recovery path processing that runs full Argon2id unlocks for every slot before MAC validation (F16). An unauthenticated remote attacker can supply crafted files with extreme memory_cost values (e.g., 1 TiB for Argon2, 128 GiB for v3 legacy) to trigger OOM kills or process wedging before password verification. Version 1.4.9 and later implement hard caps on parallel costs, fold shadowed/legacy configs into cost estimation, and enforce per-slot memory ceilings during recovery.

Affected products

jahlives openssl_encrypt before 1.4.9

Identifiers

CVE-2026-81699
PYSEC-2026-3961

Timeline

2026-08-27: disclosed
2026-08-27: patched: Version 1.4.9 released with fixes

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.