What is GHSA-m9c9-3x53-3cf8?

GHSA-m9c9-3x53-3cf8 is a security advisory published by GitHub Security Advisories with High severity. openssl_encrypt before 1.4.9 fails to validate the total field from QR JSON payloads before...

Which CVE IDs does GHSA-m9c9-3x53-3cf8 cover?

GHSA-m9c9-3x53-3cf8 covers the following CVE IDs: CVE-2026-81693. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-m9c9-3x53-3cf8?

GHSA-m9c9-3x53-3cf8 has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

GHSA-m9c9-3x53-3cf8HighCVSS 7.5

openssl_encrypt before 1.4.9 fails to validate the total field from QR JSON payloads before...

Vendor

GitHub Security Advisories

Published

August 27, 2026

Last Modified

August 27, 2026

🔗 CVE IDs covered (1)

CVE-2026-81693 →

📋 Description

openssl_encrypt before 1.4.9 fails to validate the total field from QR JSON payloads before materializing ranges. Attackers can supply crafted QR images with extremely large total values to trigger unbounded memory allocation and cause denial of service through out-of-memory conditions.

🔗 References (4)

https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-r23m-gf2m-8www
https://nvd.nist.gov/vuln/detail/CVE-2026-81693
https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-denial-of-service-via-qr-total-field
https://github.com/advisories/GHSA-m9c9-3x53-3cf8