CVE-2026-81692— openssl_encrypt before 1.4.9 Denial of Service via STREAMINFO
Quick assessment
Affected
jahlives openssl_encrypt
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
（pip 包名： ）在 1.4.8 及更早版本中，未对 FLAC 文件 36 位 中的 字段进行校验，便直接使用该字段来确定内存分配大小（通过 ）。一个大小约为 50 字节的构造型 FLAC 文件若声明约 1 亿个采样点，会触发数 GB 级别的内存分配，导致在执行 时发生内存耗尽型拒绝服务（OOM DoS）。该问题已在 1.4.9 版本中修复；1.4.x 和 1.5.x 两条版本线均受影响。
Possible ATT&CK Techniques 1 AI
T1080 · Taint Shared ContentAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| jahlives | openssl_encrypt | < 1.4.9 |
affected |
1.4.9 |
unaffected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-81692
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
openssl_encrypt before 1.4.9 Denial of Service via STREAMINFO
Source: CVE Program / CVE List V5
Vulnerability Description
openssl_encrypt (pip: openssl-encrypt) versions 1.4.8 and earlier fail to validate the 36-bit STREAMINFO total_samples field of FLAC files before using it to size an allocation (np.random.randint(size=(total_samples, channels))). A ~50-byte crafted FLAC file declaring ~100 million samples causes a multi-gigabyte memory allocation, leading to out-of-memory denial of service during 'decrypt --stego-extract'. The issue is fixed in 1.4.9; both the 1.4.x and 1.5.x lines are affected.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
未经控制的内存分配
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| jahlives | openssl_encrypt | 0 ~ 1.4.9 | - |
|
II. Public POCs for CVE-2026-81692
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-81692
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-81692 (2)
Same Patch Batch · jahlives · 2026-08-27 · 36 CVEs total
| CVE-2026-81707 | 9.8 CRITICAL | openssl_encrypt before 1.4.9 ANSI Escape Injection via Identity Email |
| CVE-2026-81701 | 9.8 CRITICAL | openssl_encrypt before 1.4.9 Arbitrary Code Execution via unsigned plugin |
| CVE-2026-81700 | 9.8 CRITICAL | openssl_encrypt before 1.4.9 GPG Signature Verification Bypass |
| CVE-2026-81702 | 9.8 CRITICAL | openssl_encrypt before 1.4.9 Key Substitution via Identity Load |
| CVE-2026-81683 | 8.4 HIGH | openssl_encrypt before 1.4.9 Plaintext Private Key Storage |
| CVE-2026-81719 | 7.8 HIGH | openssl_encrypt before 1.4.9 Remote Code Execution via Plugin |
| CVE-2026-81704 | 7.5 HIGH | openssl_encrypt before 1.4.9 Weak Key Derivation via D-Bus |
| CVE-2026-81691 | 7.5 HIGH | openssl_encrypt before 1.4.9 Credential Leakage via Unvalidated Server URLs |
| CVE-2026-81721 | 7.5 HIGH | openssl_encrypt before 1.4.9 Denial of Service via KDF |
| CVE-2026-81698 | 7.5 HIGH | openssl_encrypt before 1.4.9 Shell Injection via info command |
| CVE-2026-81693 | 7.5 HIGH | openssl_encrypt before 1.4.9 Denial of Service via QR total field |
| CVE-2026-81705 | 7.5 HIGH | openssl-encrypt before 1.4.9 Password Cleartext Leak via Debug |
| CVE-2026-81689 | 7.5 HIGH | openssl_encrypt before 1.4.9 Weak Pepper Key Derivation |
| CVE-2026-81699 | 7.5 HIGH | openssl_encrypt before 1.4.9 Denial of Service via unbounded KDF cost |
| CVE-2026-81688 | 7.5 HIGH | openssl_encrypt before 1.4.9 Plaintext Confirmation Oracle via SHA-256 |
| CVE-2026-81718 | 7.5 HIGH | openssl_encrypt before 1.4.9 Weak Cryptographic Parameters |
| CVE-2026-81690 | 7.3 HIGH | verify-usb before 1.4.9 Symlink Directory Traversal Code Execution |
| CVE-2026-81714 | 7.0 HIGH | openssl_encrypt before 1.4.9 Plugin Signing Trust Anchor Enrollment Bypass |
| CVE-2026-81706 | 6.8 MEDIUM | openssl_encrypt before 1.4.9 Key Substitution via Identity Shadowing |
| CVE-2026-81686 | 6.2 MEDIUM | openssl_encrypt before 1.4.9 D-Bus Properties Authorization Bypass |
Showing top 20 of 36 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: openssl_encrypt
-
CVE-2026-81721
openssl_encrypt before 1.4.9 Denial of Service via KDF -
CVE-2026-81719
openssl_encrypt before 1.4.9 Remote Code Execution via Plugi -
CVE-2026-81720
openssl_encrypt before 1.4.9 Denial of Service via Unbounded -
CVE-2026-81718
openssl_encrypt before 1.4.9 Weak Cryptographic Parameters -
CVE-2026-81717
openssl_encrypt before 1.4.9 Integrity Bypass via Added File
Same vendor: jahlives
-
CVE-2026-81721
openssl_encrypt before 1.4.9 Denial of Service via KDF -
CVE-2026-81719
openssl_encrypt before 1.4.9 Remote Code Execution via Plugi -
CVE-2026-81720
openssl_encrypt before 1.4.9 Denial of Service via Unbounded -
CVE-2026-81718
openssl_encrypt before 1.4.9 Weak Cryptographic Parameters -
CVE-2026-81717
openssl_encrypt before 1.4.9 Integrity Bypass via Added File
Same weakness: CWE-789
-
CVE-2026-81693
openssl_encrypt before 1.4.9 Denial of Service via QR total -
CVE-2026-44253
Wazuh: Cluster Protocol Memory Exhaustion (DoS) via unbounde -
CVE-2026-75935
Memory-amplification denial of service via declared-length p -
CVE-2026-69219
RabbitMQ Java client ValueReader: Oversized LongString/bytes -
CVE-2026-72639
Memory Allocation with Excessive Size Value in Elasticsearch
V. Comments for CVE-2026-81692
No comments yet