Vulnerability Description
openssl_encrypt before 1.4.9 fails to validate the total field from QR JSON payloads before materializing ranges. Attackers can supply crafted QR images with extremely large total values to trigger unbounded memory allocation and cause denial of service through out-of-memory conditions.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Jahlives | Openssl Encrypt | < 1.4.9 |
Related Weaknesses (CWE)
References
- https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-r23m-gf2m-8Vendor Advisory
- https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-denial-of-servThird Party Advisory
FAQ
What is CVE-2026-81693?
CVE-2026-81693 is a vulnerability with a CVSS score of 7.5 (HIGH). openssl_encrypt before 1.4.9 fails to validate the total field from QR JSON payloads before materializing ranges. Attackers can supply crafted QR images with extremely large total values to trigger un...
How severe is CVE-2026-81693?
CVE-2026-81693 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-81693?
Check the references section above for vendor advisories and patch information. Affected products include: Jahlives Openssl Encrypt.