CVE-2026-81693: openssl_encrypt before 1.4.9 Denial of Service via QR total field
opensslencrypt before 1.4.9 fails to validate the total field from QR JSON payloads before materializing ranges. Attackers can supply crafted QR images with extremely large total values to trigger unbounded memory allocation and cause denial of service through out-of-memory conditions.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this denial-of-service issue?
Deployments using OpenSSL openssl_encrypt versions before 1.4.9 are affected when they process QR JSON payloads or QR images containing attacker-controlled total fields.
What does an attacker need to do to trigger the issue?
An attacker needs to provide a crafted QR image whose JSON payload contains an extremely large total value. No privileges or user interaction are required according to the listed vector.
What is the operational impact of successful exploitation?
The application can attempt unbounded memory allocation while materializing ranges, resulting in out-of-memory conditions and denial of service. The provided severity vector indicates availability impact only, with no stated confidentiality or integrity impact.
How can I determine whether my environment is affected?
Identify whether OpenSSL openssl_encrypt is below version 1.4.9 and whether it processes QR-derived JSON input. Systems that do not process such QR payloads are not described as reachable through this issue.