CVE-2026-81693
8.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Summary
openssl_encrypt before 1.4.9 fails to validate the total field from QR JSON payloads before materializing ranges. Attackers can supply crafted QR images with extremely large total values to trigger unbounded memory allocation and cause denial of service through out-of-memory conditions.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| jahlives | openssl_encrypt | 0 < 1.4.9 | affected |
| jahlives | openssl_encrypt | 1.4.9 | unaffected |
Weaknesses
- CWE-789: Memory Allocation with Excessive Size Value
ADP Enrichment
CISA ADP Vulnrichment
- SSVC:
- Exploitation: none
- Automatable: yes
- Technical Impact: partial
References
- https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-r23m-gf2m-8www
- https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-denial-of-service-via-qr-total-field
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.