CVE-2026-81693

jahlives openssl_encrypt

Published 27 Aug 2026 · updated 2 Sept 2026 · Analyzed

8.7 High · CVSS 4.0, vulncheck.com

Description

openssl_encrypt before 1.4.9 fails to validate the total field from QR JSON payloads before materializing ranges. Attackers can supply crafted QR images with extremely large total values to trigger unbounded memory allocation and cause denial of service through out-of-memory conditions.

References

github.com/jahlives/openssl_encrypt/security/advisories/GHSA-r23m-gf2m-8www · Vendor Advisory
www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-denial-of-service-via-qr-total-field · Third Party Advisory