EUVD-2026-40229
GHSA-55gr-9963-833c
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
AC:H for required timing precision and volume; C:L for incremental tag-byte leakage; I:L added because successful exploitation enables AEAD authentication forgery not reflected in NVD's I:N.
Primary rating from Vendor (CPANSec).
CVSS VectorVendor: CPANSec
Lifecycle Timeline
3DescriptionCVE.org
CryptX versions before 0.088_001 for Perl compare AEAD authentication tags in non-constant time in the streaming decrypt_done path.
The decrypt_done($tag) form compares it against the computed tag with memNE (memcmp() != 0), which short-circuits on the first differing byte, so its run time depends on the number of matching leading bytes. This affects all five AEAD modes: GCM, CCM, ChaCha20Poly1305, EAX and OCB. The one-shot *_decrypt_verify helpers are unaffected; they verify the tag inside libtomcrypt with a constant-time comparison.
The timing difference is a tag-verification oracle. An attacker who can submit many candidate tags for the same nonce, ciphertext and associated data while measuring the timing precisely enough may recover the expected tag byte by byte and forge a message that verifies.
AnalysisAI
Non-constant-time AEAD authentication tag comparison in CryptX before 0.088_001 for Perl exposes a timing oracle in the streaming decrypt_done path, enabling authentication tag forgery across five AEAD cipher modes: GCM, CCM, ChaCha20Poly1305, EAX, and OCB. An attacker who can submit many candidate tags for a fixed nonce and ciphertext while precisely measuring response timing can recover the expected tag byte-by-byte and forge authenticated messages. No public exploit code exists and CISA has not listed this in KEV; EPSS is 0.23% (13th percentile), consistent with SSVC's 'Exploitation: none' rating at time of disclosure.
Technical ContextAI
CryptX (CPE: cpe:2.3:a:mik:cryptx) is a Perl CPAN module wrapping libtomcrypt that provides symmetric encryption, hashing, and authenticated encryption primitives. The root cause is CWE-208 (Observable Timing Discrepancy): the streaming decrypt_done($tag) method compares the caller-supplied tag against the internally computed tag using Perl's memNE macro, which wraps memcmp() and short-circuits on the first differing byte, causing execution time to correlate directly with the number of leading bytes that match. This leaks expected tag byte values incrementally to a timing-capable attacker. The flaw spans all five AEAD modes supported by the streaming API. Critically, the one-shot *_decrypt_verify helper functions delegate tag comparison to libtomcrypt's internal constant-time routine and are entirely unaffected, so the vulnerability is isolated to the multi-step streaming API code path introduced separately from the one-shot wrappers.
RemediationAI
Upgrade CryptX to version 0.088_001 or later, which replaces the non-constant-time memNE comparison in decrypt_done with a constant-time tag verification routine. The upstream fix diff is available at https://github.com/DCIT/perl-CryptX/commit/7e56347d420aaf43b2ee1586f4a230492ccf1642.patch and the release changelog is published at https://metacpan.org/release/MIK/CryptX-0.088_001/changes. As an interim workaround where immediate upgrade is not feasible, refactor streaming AEAD decryption to use the one-shot *_decrypt_verify helper functions instead of the streaming decrypt_done path, since those helpers perform tag comparison inside libtomcrypt using a constant-time routine. Note that migrating from streaming to one-shot mode requires buffering the entire ciphertext before decryption, which has memory implications for large payloads and may require API-level refactoring.
Denial-of-service via stack buffer overflow in CryptX (Perl cryptography module) versions before 0.088_001 affects four
PRNG state reuse across forked processes in CryptX for Perl allows remote attackers to recover private signing keys thro
Same weakness CWE-208 – Observable Timing Discrepancy
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today