Is CVE-2026-81693 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-81693 being exploited in the wild.

How severe is CVE-2026-81693?

High severity, with a CVSS score of 7.5, published 27 August 2026.

Which products and versions are affected?

Jahlives Openssl Encrypt before 1.4.9; openssl-encrypt (PyPI) ECOSYSTEM:introduced=0,fixed=1.4.9.

Is there a fix for CVE-2026-81693?

Yes. openssl-encrypt (PyPI): upgrade to 1.4.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-81693 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-81693?

Check whether you run Jahlives Openssl Encrypt or openssl-encrypt (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-81693: openssl_encrypt unbounded memory allocation in QR JSON parsing

CVE-2026-81693 · Severity: high · CVSS 7.5 · Published 2026-08-27

openssl_encrypt is a Python library for QR code processing used in cryptographic workflows. An attacker can craft malicious QR images with extremely large values in the "total" field, causing the library to attempt unbounded memory allocation and exhaust system resources, leading to service outages or application crashes.

Technologies: Jahlives Openssl Encrypt, openssl-encrypt (PyPI). Vendors: Jahlives, PyPI.

Quick answers

Is CVE-2026-81693 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-81693 being exploited in the wild.
How severe is CVE-2026-81693?: High severity, with a CVSS score of 7.5, published 27 August 2026.
Which products and versions are affected?: Jahlives Openssl Encrypt before 1.4.9; openssl-encrypt (PyPI) ECOSYSTEM:introduced=0,fixed=1.4.9.
Is there a fix for CVE-2026-81693?: Yes. openssl-encrypt (PyPI): upgrade to 1.4.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-81693 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-81693?: Check whether you run Jahlives Openssl Encrypt or openssl-encrypt (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

openssl-encrypt (PyPI): upgrade to 1.4.9 or later
```
pip install "openssl-encrypt>=1.4.9"
```

Technical details

The vulnerability exists in the _parse_multi_qr_data function, which accepts a "total" field from untrusted QR JSON payloads without validation and directly uses it to materialize a Python set via range(1, total+1). An attacker can supply a crafted QR image declaring total=10^12 or higher, forcing the application to allocate approximately 10^12 integer objects until out-of-memory (OOM) conditions occur. The attack requires no authentication and is reachable via network if the application processes QR codes from untrusted sources. The fix in version 1.4.9 validates part/total as integers within the range 1–99 before any range materialization, matching constraints enforced during QR creation. Both the 1.4.x and 1.5.x product lines are affected.

Affected products

jahlives openssl_encrypt before 1.4.9

Identifiers

CVE-2026-81693
PYSEC-2026-3798

Timeline

2026-08-12: disclosed: GitHub Security Advisory (GHSA-r23m-gf2m-8www) published
2026-08-27: advisory: CVE-2026-81693 assigned and published on NVD
2026-08-12: patched: Fix released in version 1.4.9

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.