CVE-2026-81693CWE-789

CVE-2026-81693

High · published August 27, 2026

CVSS v3.1

7.5

EPSS

Percentile

41.4

In the wild

Unconfirmed

What it is

openssl_encrypt before 1.4.9 fails to validate the total field from QR JSON payloads before materializing ranges. Attackers can supply crafted QR images with extremely large total values to trigger unbounded memory allocation and cause denial of service through out-of-memory conditions.

The record

Technical detail

CVSS v3.1: 7.5 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0: 8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS: 0.00493 · 41.4th percentile
Weakness: CWE-789 · Memory Allocation with Excessive Size Value
Published: 2026-08-27T21:20Z

Affected products (1)

Product	Versions	Fixed in
jahlives/openssl_encrypt	< 1.4.9	1.4.9

References (2)

https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-r23m-gf2m-8www · [email protected]https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-denial-of-service-via-qr-total-field · [email protected]

EPSS history

Timeline

27 AUG 14:50Z
openssl_encrypt before 1.4.9 Denial of Service via QR total field
cvelistv5