Is CVE-2026-81721 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-81721 being exploited in the wild.

How severe is CVE-2026-81721?

High severity, with a CVSS score of 7.5, published 27 August 2026.

Which products and versions are affected?

openssl-encrypt (PyPI) ECOSYSTEM:introduced=0,fixed=1.4.9.

Is there a fix for CVE-2026-81721?

Yes. openssl-encrypt (PyPI): upgrade to 1.4.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-81721 attacked?

It is attacked over the network.

Am I affected by CVE-2026-81721?

Check whether you run Jahlives Openssl Encrypt or openssl-encrypt (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-81721: openssl_encrypt KDF cost parameter validation bypass

CVE-2026-81721 · Severity: high · CVSS 7.5 · Published 2026-08-27

openssl_encrypt is a Python library for encrypting and decrypting files using password-based key derivation. An attacker can craft a malicious encrypted file that declares extremely large memory-hard key derivation function (KDF) parameters, causing the decryption process to allocate gigabytes to terabytes of memory before the password is even validated. This allows an unauthenticated attacker to crash the application or entire system without needing the correct password.

Technologies: Jahlives Openssl Encrypt, openssl-encrypt (PyPI). Vendors: Jahlives, PyPI.

Quick answers

Is CVE-2026-81721 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-81721 being exploited in the wild.
How severe is CVE-2026-81721?: High severity, with a CVSS score of 7.5, published 27 August 2026.
Which products and versions are affected?: openssl-encrypt (PyPI) ECOSYSTEM:introduced=0,fixed=1.4.9.
Is there a fix for CVE-2026-81721?: Yes. openssl-encrypt (PyPI): upgrade to 1.4.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-81721 attacked?: It is attacked over the network.
Am I affected by CVE-2026-81721?: Check whether you run Jahlives Openssl Encrypt or openssl-encrypt (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

openssl-encrypt (PyPI): upgrade to 1.4.9 or later
```
pip install "openssl-encrypt>=1.4.9"
```

Technical details

The vulnerability exists in openssl_encrypt versions before 1.4.9, which fails to validate KDF cost parameters (such as Argon2 memory_cost, scrypt N, or balloon space_cost) when reading encrypted file metadata and keystore headers. An attacker can craft a malicious encrypted file declaring arbitrarily large memory-hard KDF parameters that are consumed during the key derivation phase, before any password authentication occurs. This pre-authentication memory exhaustion triggers unbounded allocation of gigabytes to terabytes of RAM, causing an out-of-memory crash with no authentication required. The fix applies a memory ceiling (default 8 GiB, configurable via --allow-high-kdf-cost flag) to both file decryption and keystore load operations.

Affected products

openssl_encrypt (jahlives) openssl_encrypt before 1.4.9

Identifiers

CVE-2026-81721
PYSEC-2026-3803

Timeline

2026-08-27: disclosed
2026-08-27: patched: version 1.4.9 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.