Crypt::Age CVE-2026-85783

Triggered specifically when the application decrypts an age file it did not create - i.e. any call to Crypt::Age decrypt, decrypt_file, or decrypt_filehandle on attacker-influenced input. The amplification requires that the caller hold one or more X25519 identities (cost scales as stanzas × identities) and that the attacker can supply an age header with an arbitrarily large count of 98-byte X25519 recipient stanzas; the header MAC cannot short-circuit this because its key is derived from the yet-unrecovered file key. LIMITING FACTORS: impact is confined to CPU/availability (no RCE, no data exposure); the victim must actively attempt decryption of the malicious file (automated or service-side decryption pipelines are the realistic high-risk target); and only Crypt::Age versions before 0.004 are affected - upgrading to 0.004+ removes the condition. Authentication requirements not confirmed from available data (no CVSS vector provided).

This is a denial-of-service (CPU exhaustion / asymmetric resource amplification, CWE-770 + CWE-405) in the Perl Crypt::Age module, not a code-execution or data-disclosure flaw. No CVSS vector, EPSS score, KEV listing, or public POC was provided in the input, so there are NO exploitation-probability or active-exploitation signals to weigh - exploitation status is therefore 'no public exploit identified at time of analysis.' Severity must be inferred entirely from the description. The real-world risk is moderate-to-low and is gated almost entirely by prevalence: Crypt::Age is an obscure CPAN distribution, so the exposed population is small. The technical issue is legitimate and clearly described - the header parser accepts an unbounded number of recipient stanzas and unwrap_file_key tries every held identity against every X25519 stanza (each attempt = one X25519 scalar multiplication + HKDF + ChaCha20-Poly1305 open), and the header MAC cannot be verified first because its key is derived from the file key that only a successful unwrap produces. That design makes the amplification genuine. However, impact is bounded to availability/CPU, there is no memory-unbounded allocation claimed, and the victim must actively decrypt an attacker-supplied file. MISSING DATA to flag explicitly: no official CVSS vector (NVD shows N/A), no EPSS, no KEV, no POC - all severity metrics below are this analyst's independent assessment, not vendor-confirmed.

An attacker crafts an age-encrypted file containing a very large number (unbounded) of 98-byte X25519 recipient stanzas and delivers it to a victim or service that decrypts files it did not author via decrypt, decrypt_file, or decrypt_filehandle. Because every stanza forces a full X25519 scalar multiplication per held identity before the (unverifiable-first) header MAC can reject the file, decryption consumes CPU proportional to stanza_count × identities, exhausting the processing host. No public exploit code was identified, but the attack is trivial to construct from the description.