{"id":"CVE-2026-81693","aliases":["PYSEC-2026-3798","GHSA-r23m-gf2m-8www"],"title":"openssl_encrypt before 1.4.9 fails to validate the total field from QR JSON payloads before materializing ranges. Attackers can supply cr…","summary":"openssl_encrypt before 1.4.9 fails to validate the total field from QR JSON payloads before materializing ranges. Attackers can supply crafted QR images with extremely large total values to trigger unbounded memory allocation and cause d…","severity":"none","vendor":"openssl-encrypt","product":"openssl-encrypt","ecosystem":"pip","affected":["openssl-encrypt < 1.4.9"],"patched":["openssl-encrypt 1.4.9"],"published":"2026-08-27","updated":"2026-09-03","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/PYSEC-2026-3798","references":[{"url":"https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-r23m-gf2m-8www"},{"url":"https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-denial-of-service-via-qr-total-field"}],"tags":["osv","pip"],"epss":0.00493,"epssPercentile":0.39704,"ingestedAt":"2026-09-03T19:32:12.240Z","slug":"CVE-2026-81693","body":"## Overview\n\nopenssl_encrypt before 1.4.9 fails to validate the total field from QR JSON payloads before materializing ranges. Attackers can supply crafted QR images with extremely large total values to trigger unbounded memory allocation and cause denial of service through out-of-memory conditions.\n\n## Affected packages\n\n- `openssl-encrypt < 1.4.9`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `openssl-encrypt 1.4.9`","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}