What’s Vulnerable › Vulnerabilities

CVE-2026-81704: openssl_encrypt before 1.4.9 Weak Key Derivation via D-Bus

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-27 · updated 2026-09-03
• Weakness: CWE-916

Description

openssl_encrypt versions before 1.4.9 contain a weak key derivation vulnerability in the D-Bus CryptoService.EncryptFile handler that uses unstretched SHA-256 instead of Argon2id. Attackers can perform offline password guessing against encrypted files roughly six to seven orders of magnitude faster than documented protection by exploiting the missing key stretching and hash rounds.

Affected products

• jahlives openssl_encrypt: before 1.4.9 — fixed in 1.4.9

How to fix

Upgrade to a fixed version: jahlives openssl_encrypt 1.4.9. Check the vendor advisory for mitigations.

References

• https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-v9r6-grch-fxw7
• https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-weak-key-derivation-via-d-bus

Get alerted when CVE-2026-81704 or the next vulnerability affects your stack