p PatchFirst

CVE-2026-81693

CVE-2026-81693 · openssl_encrypt before 1.4.9 Denial of Service via QR total field

This page contains facts from public vulnerability sources. Check the original advisory before updating.

openssl_encrypt before 1.4.9 fails to validate the total field from QR JSON payloads before materializing ranges. Attackers can supply crafted QR images with extremely large total values to trigger unbounded memory allocation and cause denial of service through out-of-memory conditions.

CVSS 8.7 · High · EPSS 0.5% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • openssl_encrypt

    Versions
    • ≥ 0, < 1.4.9: Affected (semver)
    • 1.4.9: Not affected (semver)

    Update to 1.4.9

  • openssl-encrypt PyPI

    Versions
    • 0.2.2
    • 0.2.3
    • 0.2.4
    • 0.2.5
    • 0.2.6
    • 0.3.0
    • 0.3.1
    • 0.3.2
    • 0.3.3
    • 0.4.0
    • 0.4.1
    • 0.4.2
    • 0.4.3
    • 0.4.4
    • 0.5.0
    • 0.5.1
    • 0.5.3
    • 0.6.0rc1
    • 0.7.0rc2
    • 0.7.1
    • 0.7.2
    • 0.8.0
    • 0.8.1
    • 0.8.2
    • 0.9.2
    • 1.0.0
    • 1.0.1
    • 1.0.2
    • 1.0.3
    • 1.1.0
    • 1.2.0
    • 1.2.1
    • 1.3.0
    • 1.3.1
    • 1.3.2
    • 1.3.3
    • 1.3.4
    • 1.3.5
    • 1.4.0
    • 1.4.0b3
    • 1.4.0b4
    • 1.4.0b5
    • 1.4.0b6
    • 1.4.0b7
    • 1.4.0b8
    • 1.4.1
    • 1.4.1rc2
    • 1.4.2
    • 1.4.4
    • 1.4.5
    • 1.4.6
    • 1.4.7
    • 1.4.8
    Affected ranges
    • ECOSYSTEM: < 1.4.9

    Update to 1.4.9

Original sources

Check your server →