Weak PBKDF2-HMAC-SHA256 Implementation in OpenSSL Encryption Product

CVE-2026-81718

What is CVE-2026-81718?

The openssl_encrypt product suffers from a vulnerability due to its usage of under-parameterized PBKDF2-HMAC-SHA256, employing only 100,000 iterations for protecting PQC keyfile private keys and just 10,000 iterations for dual-encryption file-password verification. This inadequacy allows attackers to exploit the situation by obtaining keyfiles or encrypted files, enabling them to perform offline brute-force attacks on wrapping passwords with the aid of GPU or ASIC acceleration.

References