CVE-2026-81686

Name of the Vulnerable Software and Affected Versions openssl encrypt versions 1.4.x through 1.4.8

Description An optional D-Bus crypto service contains a flaw where the 'org.freedesktop.DBus.Properties.Set' method lacks polkit authorization checks and value validation. A local user on the system bus can call this method without authorization to modify the MaxConcurrentOperations variable (setting it to 0, a negative value, or an excessively large value) or the DefaultTimeout variable. These actions can cause the concurrency gate to refuse operations or remove limits, leading to a persistent denial of service of the root daemon.

Recommendations Update openssl encrypt to version 1.4.9 or later.