oss-security - CVE-2026-13758: CryptX versions before 0.088_001 for Perl compare AEAD authentication tags in non-constant time in the streaming decrypt

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <1CFE6D39-898F-49E9-8036-B6D5801316D5@stig.io>
Date: Mon, 29 Jun 2026 22:44:41 +0200
From: Stig Palmquist <stig@...g.io>
To: cve-announce@...urity.metacpan.org,
 oss-security@...ts.openwall.com
Subject: CVE-2026-13758: CryptX versions before 0.088_001 for Perl
 compare AEAD authentication tags in non-constant time in the streaming
 decrypt_done path

========================================================================
CVE-2026-13758                                       CPAN Security Group
========================================================================

        CVE ID:  CVE-2026-13758
  Distribution:  CryptX
      Versions:  before 0.088_001

      MetaCPAN:  https://metacpan.org/dist/CryptX
      VCS Repo:  https://github.com/DCIT/perl-CryptX

CryptX versions before 0.088_001 for Perl compare AEAD authentication
tags in non-constant time in the streaming decrypt_done path

Description
-----------
CryptX versions before 0.088_001 for Perl compare AEAD authentication
tags in non-constant time in the streaming decrypt_done path.

The decrypt_done($tag) form compares it against the computed tag with
memNE (memcmp() != 0), which short-circuits on the first differing
byte, so its run time depends on the number of matching leading bytes.
This affects all five AEAD modes: GCM, CCM, ChaCha20Poly1305, EAX and
OCB. The one-shot *_decrypt_verify helpers are unaffected; they verify
the tag inside libtomcrypt with a constant-time comparison.

The timing difference is a tag-verification oracle. An attacker who can
submit many candidate tags for the same nonce, ciphertext and
associated data while measuring the timing precisely enough may recover
the expected tag byte by byte and forge a message that verifies.

Problem types
-------------
- CWE-208 Observable Timing Discrepancy

Solutions
---------
Upgrade to CryptX 0.088_001 or later.

References
----------
https://github.com/DCIT/perl-CryptX/commit/7e56347d420aaf43b2ee1586f4a230492ccf1642.patch
https://metacpan.org/release/MIK/CryptX-0.088_001/changes

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.