Denial of Service Vulnerability in OpenSSL Encrypt by OpenSSL
CVE-2026-81693

8.7HIGH

Key Information:

Vendor

Jahlives

Status
OpenSSL Encrypt
Vendor
CVE Published:
27 August 2026

What is CVE-2026-81693?

OpenSSL Encrypt versions prior to 1.4.9 are susceptible to a vulnerability where the total field in QR JSON payloads is not properly validated. This oversight allows attackers to create malicious QR images with excessively large total values, leading to unbounded memory allocation. The exploitation of this flaw can result in denial of service conditions due to out-of-memory errors, potentially disrupting the application's functionality.

Affected Version(s)

openssl_encrypt 0 < 1.4.9

openssl_encrypt 1.4.9

References

https://github.com/jahlives/openssl_encrypt/security/advi...
vendor-advisory
https://www.vulncheck.com/advisories/openssl-encrypt-befo...
third-party-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.