Description

openssl_encrypt before 1.4.9 fails to validate the total field from QR JSON payloads before materializing ranges. Attackers can supply crafted QR images with extremely large total values to trigger unbounded memory allocation and cause denial of service through out-of-memory conditions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-27T17:20:59.297Z",
  "pubdate": "2026-08-27T17:20:59.297Z",
  "executiveSummary": "The openssl_encrypt library, in versions prior to 1.4.9, contains a critical vulnerability related to the improper validation of input data within QR JSON payloads.\nThe vulnerability is classified as an improper input validation issue that leads to uncontrolled resource consumption.\nAttackers can leverage this flaw by supplying a maliciously crafted QR image containing an excessively large 'total' field value.\nUpon processing this payload, the library attempts to materialize ranges based on the unverified 'total' parameter, triggering an unbounded memory allocation.\nThis leads to an immediate out-of-memory (OOM) condition, resulting in a denial-of-service (DoS) state for the affected system.\nThe vulnerability does not require authentication to exploit, as it can be triggered remotely by providing the malicious input to any service utilizing the affected component for QR payload processing.\nThe primary risk is the total exhaustion of system memory, which can crash the host process or the entire operating system, disrupting service availability.",
  "technicalDetails": "The root cause of the vulnerability resides in the insufficient sanitization of the 'total' field within JSON-encoded QR payloads processed by openssl_encrypt prior to version 1.4.9.\nWhen the library parses a QR image, it decodes the associated JSON payload and extracts the 'total' value to define the bounds of internal range structures. The implementation fails to enforce a maximum integer threshold or validate the sanity of the 'total' parameter before using it as an argument for memory allocation functions.\nThe attack flow begins when an adversary generates a specifically crafted QR image where the JSON payload specifies an extreme value for the 'total' field. This image is then transmitted to the target system that relies on the vulnerable library to deserialize and interpret the QR data.\nOnce the library receives the payload, the deserialization logic invokes a routine that attempts to allocate a block of memory proportionate to the 'total' value. Because the input remains unvalidated, the system attempts to allocate an amount of memory that exceeds the physical or virtual memory capacity of the environment.\nThis unbounded allocation triggers the operating system's OOM killer or results in an immediate allocation failure, crashing the application or forcing the system into an unresponsive state.\nExploitation requires no specific privileges or authentication from the attacker, as the vulnerability exists at the processing layer of the input stream. This makes the vulnerability highly exploitable via network-based vectors if the service is exposed to arbitrary or untrusted QR inputs.\nThe lack of bounds checking on the 'total' field creates a direct path for resource exhaustion. The memory allocation occurs before any logic is applied to verify if the requested range is logical or within the constraints of the available system resources. Consequently, the memory exhaustion happens almost instantaneously upon payload arrival, minimizing the opportunity for intrusion detection systems to mitigate the request before the crash occurs.\nThe impact is primarily a Denial of Service (DoS) resulting from the exhaustion of available system memory. While this is primarily an availability issue, repeated exploitation can be used to keep services offline indefinitely, providing a persistent disruption vector for any infrastructure integrating this version of openssl_encrypt."
}