High severity7.5NVD Advisory· Published Aug 27, 2026

CVE-2026-81693

Description

openssl_encrypt before 1.4.9 fails to validate the total field from QR JSON payloads before materializing ranges. Attackers can supply crafted QR images with extremely large total values to trigger unbounded memory allocation and cause denial of service through out-of-memory conditions.

Affected products

Jahlives/Openssl Encryptinferred2 versions
<1.4.9+ 1 more
- (no CPE)range: <1.4.9
- (no CPE)range: <1.4.9

Patches

Vulnerability mechanics

References

github.com/jahlives/openssl_encrypt/security/advisories/GHSA-r23m-gf2m-8wwwnvd
www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-denial-of-service-via-qr-total-fieldnvd

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000