CVE-2026-81693

EUVD-2026-67049
openssl_encrypt before 1.4.9 fails to validate the total field from QR JSON payloads before materializing ranges. Attackers can supply crafted QR images with extremely large total values to trigger unbounded memory allocation and cause denial of service through out-of-memory conditions.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 40.57%
Affected Products (NVD)
VendorProductVersion
jahlivesopenssl_encrypt
𝑥
< 1.4.9
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-r23m-gf2m-8www
https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-denial-of-service-via-qr-total-field