---
id: CVE-2026-81693
title: openssl_encrypt before 1.4.9 Denial of Service via QR total field
summary: >-
  openssl_encrypt before 1.4.9 fails to validate the total field from QR JSON
  payloads before materializing ranges. Attackers can supply crafted QR images
  with extremely large total values to trigger unbounded memory allocation and
  cause d…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-789
vendor: jahlives
product: openssl_encrypt
affected:
  - openssl_encrypt < 1.4.9
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-08-27T18:31:28.585604Z'
published: '2026-08-27'
updated: '2026-10-01'
sourceUpdated: '2026-10-01T15:21:25.346Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-81693'
references:
  - url: >-
      https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-r23m-gf2m-8www
    label: GitHub Security Advisory (GHSA-r23m-gf2m-8www)
  - url: >-
      https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-denial-of-service-via-qr-total-field
    label: >-
      VulnCheck Advisory: openssl_encrypt before 1.4.9 Denial of Service via QR
      total field
tags:
  - cve.org
  - osv
  - pip
epss: 0.00493
epssPercentile: 0.42158
aliases:
  - PYSEC-2026-3798
  - GHSA-r23m-gf2m-8www
ecosystem: pip
patched:
  - openssl-encrypt 1.4.9
ingestedAt: '2026-09-03T19:32:12.240Z'
---

## Overview

openssl_encrypt before 1.4.9 fails to validate the total field from QR JSON payloads before materializing ranges. Attackers can supply crafted QR images with extremely large total values to trigger unbounded memory allocation and cause denial of service through out-of-memory conditions.

## Affected

- `openssl_encrypt < 1.4.9`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-81693)

Affected packages:

- `openssl-encrypt < 1.4.9`

Patched in:

- `openssl-encrypt 1.4.9`

Source: https://osv.dev/vulnerability/PYSEC-2026-3798