Executive brief
openssl_encrypt is a Python library for QR code processing used in cryptographic workflows. An attacker can craft malicious QR images with extremely large values in the "total" field, causing the library to attempt unbounded memory allocation and exhaust system resources, leading to service outages or application crashes.
Technical details
The vulnerability exists in the _parse_multi_qr_data function, which accepts a "total" field from untrusted QR JSON payloads without validation and directly uses it to materialize a Python set via range(1, total+1). An attacker can supply a crafted QR image declaring total=10^12 or higher, forcing the application to allocate approximately 10^12 integer objects until out-of-memory (OOM) conditions occur. The attack requires no authentication and is reachable via network if the application processes QR codes from untrusted sources. The fix in version 1.4.9 validates part/total as integers within the range 1–99 before any range materialization, matching constraints enforced during QR creation. Both the 1.4.x and 1.5.x product lines are affected.
Affected products
- jahlives openssl_encrypt before 1.4.9
Timeline
- 2026-08-12: disclosed: GitHub Security Advisory (GHSA-r23m-gf2m-8www) published
- 2026-08-27: advisory: CVE-2026-81693 assigned and published on NVD
- 2026-08-12: patched: Fix released in version 1.4.9