CVE-2026-81693 HIGH

CVE-2026-81693: openssl_encrypt before 1.4.9 Denial of Service via QR total field

Vendor Jahlives
Product openssl_encrypt
Weakness CWE-789
Published August 27, 2026
Last update August 27, 2026
View on NVD All CVEs

CVSS base score

8.7/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

openssl_encrypt before 1.4.9 fails to validate the total field from QR JSON payloads before materializing ranges. Attackers can supply crafted QR images with extremely large total values to trigger unbounded memory allocation and cause denial of service through out-of-memory conditions.

Key dates

02Disclosure timeline

August 27, 2026 CVE published
August 27, 2026 Record updated