The openssl_encrypt library from jahlives contains a flaw in versions prior to 1.4.9 where the key‑derivation function does not limit the number of iterations specified in file metadata. Crafting a file with an exceptionally large KDF iteration count forces the library to consume CPU cycles for an unbounded amount of time before the password is even verified. This results in a denial of service condition by exhausting processing resources; the weakness is classified as CWE‑400, an excessive resource consumption flaw.

The vulnerability affects the jahlives openssl_encrypt product in all releases older than 1.4.9. Users who have not upgraded past the 1.4.9‑preceding versions are at risk, as their deployments will accept and process the deliberately oversized KDF iteration counts.

With a CVSS score of 8.7, the flaw is considered high severity. Although no EPSS score is publicly available, the nature of the exploit—crafting a malicious file that drives CPU usage—suggests a realistic attack surface, especially for services that routinely parse user‑supplied encrypted files. The vulnerability can be triggered by passing a file with a high iteration count to the library’s decryption routine, and no network isolation or access control protects against it. The security advisory does not list this issue in the CISA KEV catalog, but the high impact and ease of exploitation warrant prompt attention.