openssl_encrypt (pip: openssl-encrypt) versions 1.4.8 and earlier fail to validate the 36-bit STREAMINFO total_samples field of FLAC files before using it to size an allocation (np.random.randint(size=(total_samples, channels))). A ~50-byte crafted FLAC file declaring ~100 million samples causes a multi-gigabyte memory allocation, leading to out-of-memory denial of service during 'decrypt --stego-extract'. The issue is fixed in 1.4.9; both the 1.4.x and 1.5.x lines are affected.

The Python pip package openssl-encrypt (versions 1.4.8 and earlier) contains a vulnerability in its FLAC file parsing logic. It fails to validate the 36-bit STREAMINFO total_samples field before using it to size a NumPy memory allocation. A crafted ~50-byte FLAC file declaring approximately 100 million samples can trigger a multi-gigabyte memory allocation, resulting in an out-of-memory denial of service condition. The vulnerability is triggered during the 'decrypt --stego-extract' operation. Both the 1.4.x and 1.5.x release lines are affected. The issue has been patched in version 1.4.9. Users are advised to upgrade immediately to mitigate the risk of denial of service attacks via malicious FLAC files.