{"id":"CVE-2026-81693","title":"openssl_encrypt before 1.4.9 Denial of Service via QR total field","summary":"openssl_encrypt before 1.4.9 fails to validate the total field from QR JSON payloads before materializing ranges. Attackers can supply crafted QR images with extremely large total values to trigger unbounded memory allocation and cause d…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"cna","cwe":["CWE-789"],"vendor":"jahlives","product":"openssl_encrypt","affected":["openssl_encrypt < 1.4.9"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-08-27T18:31:28.585604Z"},"published":"2026-08-27","updated":"2026-10-01","sourceUpdated":"2026-10-01T15:21:25.346Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-81693","references":[{"url":"https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-r23m-gf2m-8www","label":"GitHub Security Advisory (GHSA-r23m-gf2m-8www)"},{"url":"https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-denial-of-service-via-qr-total-field","label":"VulnCheck Advisory: openssl_encrypt before 1.4.9 Denial of Service via QR total field"}],"tags":["cve.org","osv","pip"],"epss":0.00493,"epssPercentile":0.42158,"aliases":["PYSEC-2026-3798","GHSA-r23m-gf2m-8www"],"ecosystem":"pip","patched":["openssl-encrypt 1.4.9"],"ingestedAt":"2026-09-03T19:32:12.240Z","slug":"CVE-2026-81693","body":"## Overview\n\nopenssl_encrypt before 1.4.9 fails to validate the total field from QR JSON payloads before materializing ranges. Attackers can supply crafted QR images with extremely large total values to trigger unbounded memory allocation and cause denial of service through out-of-memory conditions.\n\n## Affected\n\n- `openssl_encrypt < 1.4.9`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-81693)\n\nAffected packages:\n\n- `openssl-encrypt < 1.4.9`\n\nPatched in:\n\n- `openssl-encrypt 1.4.9`\n\nSource: https://osv.dev/vulnerability/PYSEC-2026-3798","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":214411,"id":"CVE-2026-81693","ts":1790869815835,"field":"cvss","old":null,"new":"7.5"},{"seq":214410,"id":"CVE-2026-81693","ts":1790869815835,"field":"severity","old":"none","new":"high"}]}