---
id: CVE-2026-81693
aliases:
  - PYSEC-2026-3798
  - GHSA-r23m-gf2m-8www
title: >-
  openssl_encrypt before 1.4.9 fails to validate the total field from QR JSON
  payloads before materializing ranges. Attackers can supply cr…
summary: >-
  openssl_encrypt before 1.4.9 fails to validate the total field from QR JSON
  payloads before materializing ranges. Attackers can supply crafted QR images
  with extremely large total values to trigger unbounded memory allocation and
  cause d…
severity: none
vendor: openssl-encrypt
product: openssl-encrypt
ecosystem: pip
affected:
  - openssl-encrypt < 1.4.9
patched:
  - openssl-encrypt 1.4.9
published: '2026-08-27'
updated: '2026-09-03'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/PYSEC-2026-3798'
references:
  - url: >-
      https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-r23m-gf2m-8www
  - url: >-
      https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-denial-of-service-via-qr-total-field
tags:
  - osv
  - pip
epss: 0.00493
epssPercentile: 0.3979
ingestedAt: '2026-09-03T19:32:12.240Z'
---

## Overview

openssl_encrypt before 1.4.9 fails to validate the total field from QR JSON payloads before materializing ranges. Attackers can supply crafted QR images with extremely large total values to trigger unbounded memory allocation and cause denial of service through out-of-memory conditions.

## Affected packages

- `openssl-encrypt < 1.4.9`

## Remediation

Upgrade to a patched release:

- `openssl-encrypt 1.4.9`