CVE-2026-81693 — openssl_encrypt before 1.4.9 Denial of Service via QR total field
openssl_encrypt before 1.4.9 fails to validate the total field from QR JSON payloads before materializing ranges. Attackers can supply crafted QR images with extremely large tot…
Published: 2026-08-27 · CVSS: 8.7 · CVSS 4.0
openssl_encrypt before 1.4.9 fails to validate the total field from QR JSON payloads before materializing ranges. Attackers can supply crafted QR images with extremely large total values to trigger unbounded memory allocation and cause denial of service through out-of-memory conditions.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7