CVE-2026-13758

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-13758", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "state": "PUBLISHED", "assignerShortName": "CPANSec", "dateReserved": "2026-06-29T17:50:18.724Z", "datePublished": "2026-06-29T20:42:14.612Z", "dateUpdated": "2026-06-30T13:56:55.094Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "CryptX", "product": "CryptX", "programFiles": ["inc/CryptX_AuthEnc_GCM.xs.inc", "inc/CryptX_AuthEnc_CCM.xs.inc", "inc/CryptX_AuthEnc_ChaCha20Poly1305.xs.inc", "inc/CryptX_AuthEnc_EAX.xs.inc", "inc/CryptX_AuthEnc_OCB.xs.inc"], "programRoutines": [{"name": "Crypt::AuthEnc::GCM::decrypt_done"}, {"name": "Crypt::AuthEnc::CCM::decrypt_done"}, {"name": "Crypt::AuthEnc::ChaCha20Poly1305::decrypt_done"}, {"name": "Crypt::AuthEnc::EAX::decrypt_done"}, {"name": "Crypt::AuthEnc::OCB::decrypt_done"}], "repo": "https://github.com/DCIT/perl-CryptX", "vendor": "MIK", "versions": [{"lessThan": "0.088_001", "status": "affected", "version": "0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "CryptX versions before 0.088_001 for Perl compare AEAD authentication tags in non-constant time in the streaming decrypt_done path.\n\nThe decrypt_done($tag) form compares it against the computed tag with memNE (memcmp() != 0), which short-circuits on the first differing byte, so its run time depends on the number of matching leading bytes. This affects all five AEAD modes: GCM, CCM, ChaCha20Poly1305, EAX and OCB. The one-shot *_decrypt_verify helpers are unaffected; they verify the tag inside libtomcrypt with a constant-time comparison.\n\nThe timing difference is a tag-verification oracle. An attacker who can submit many candidate tags for the same nonce, ciphertext and associated data while measuring the timing precisely enough may recover the expected tag byte by byte and forge a message that verifies."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-208", "description": "CWE-208 Observable Timing Discrepancy", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-06-29T20:42:14.612Z"}, "references": [{"tags": ["patch"], "url": "https://github.com/DCIT/perl-CryptX/commit/7e56347d420aaf43b2ee1586f4a230492ccf1642.patch"}, {"tags": ["release-notes"], "url": "https://metacpan.org/release/MIK/CryptX-0.088_001/changes"}], "solutions": [{"lang": "en", "value": "Upgrade to CryptX 0.088_001 or later."}], "source": {"discovery": "UNKNOWN"}, "title": "CryptX versions before 0.088_001 for Perl compare AEAD authentication tags in non-constant time in the streaming decrypt_done path", "x_generator": {"engine": "cpansec-cna-tool 0.1"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/06/29/19"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-06-29T22:24:14.433Z"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-06-30T13:56:51.096991Z", "id": "CVE-2026-13758", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-30T13:56:55.094Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-13758", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-30T13:56:51.096991Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-06-30T13:56:45.507Z"}}], "cna": {"title": "CryptX versions before 0.088_001 for Perl compare AEAD authentication tags in non-constant time in the streaming decrypt_done path", "source": {"discovery": "UNKNOWN"}, "affected": [{"repo": "https://github.com/DCIT/perl-CryptX", "vendor": "MIK", "product": "CryptX", "versions": [{"status": "affected", "version": "0", "lessThan": "0.088_001", "versionType": "custom"}], "packageName": "CryptX", "programFiles": ["inc/CryptX_AuthEnc_GCM.xs.inc", "inc/CryptX_AuthEnc_CCM.xs.inc", "inc/CryptX_AuthEnc_ChaCha20Poly1305.xs.inc", "inc/CryptX_AuthEnc_EAX.xs.inc", "inc/CryptX_AuthEnc_OCB.xs.inc"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "Crypt::AuthEnc::GCM::decrypt_done"}, {"name": "Crypt::AuthEnc::CCM::decrypt_done"}, {"name": "Crypt::AuthEnc::ChaCha20Poly1305::decrypt_done"}, {"name": "Crypt::AuthEnc::EAX::decrypt_done"}, {"name": "Crypt::AuthEnc::OCB::decrypt_done"}]}], "solutions": [{"lang": "en", "value": "Upgrade to CryptX 0.088_001 or later."}], "references": [{"url": "https://github.com/DCIT/perl-CryptX/commit/7e56347d420aaf43b2ee1586f4a230492ccf1642.patch", "tags": ["patch"]}, {"url": "https://metacpan.org/release/MIK/CryptX-0.088_001/changes", "tags": ["release-notes"]}], "x_generator": {"engine": "cpansec-cna-tool 0.1"}, "descriptions": [{"lang": "en", "value": "CryptX versions before 0.088_001 for Perl compare AEAD authentication tags in non-constant time in the streaming decrypt_done path.\n\nThe decrypt_done($tag) form compares it against the computed tag with memNE (memcmp() != 0), which short-circuits on the first differing byte, so its run time depends on the number of matching leading bytes. This affects all five AEAD modes: GCM, CCM, ChaCha20Poly1305, EAX and OCB. The one-shot *_decrypt_verify helpers are unaffected; they verify the tag inside libtomcrypt with a constant-time comparison.\n\nThe timing difference is a tag-verification oracle. An attacker who can submit many candidate tags for the same nonce, ciphertext and associated data while measuring the timing precisely enough may recover the expected tag byte by byte and forge a message that verifies."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-208", "description": "CWE-208 Observable Timing Discrepancy"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-06-29T20:42:14.612Z"}}}, "cveMetadata": {"cveId": "CVE-2026-13758", "state": "PUBLISHED", "dateUpdated": "2026-06-29T22:24:14.433Z", "dateReserved": "2026-06-29T17:50:18.724Z", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "datePublished": "2026-06-29T20:42:14.612Z", "assignerShortName": "CPANSec"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "CryptX", "product": "CryptX", "programFiles": ["inc/CryptX_AuthEnc_GCM.xs.inc", "inc/CryptX_AuthEnc_CCM.xs.inc", "inc/CryptX_AuthEnc_ChaCha20Poly1305.xs.inc", "inc/CryptX_AuthEnc_EAX.xs.inc", "inc/CryptX_AuthEnc_OCB.xs.inc"], "programRoutines": [{"name": "Crypt::AuthEnc::GCM::decrypt_done"}, {"name": "Crypt::AuthEnc::CCM::decrypt_done"}, {"name": "Crypt::AuthEnc::ChaCha20Poly1305::decrypt_done"}, {"name": "Crypt::AuthEnc::EAX::decrypt_done"}, {"name": "Crypt::AuthEnc::OCB::decrypt_done"}], "repo": "https://github.com/DCIT/perl-CryptX", "vendor": "MIK", "versions": [{"lessThan": "0.088_001", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "CryptX versions before 0.088_001 for Perl compare AEAD authentication tags in non-constant time in the streaming decrypt_done path.\n\nThe decrypt_done($tag) form compares it against the computed tag with memNE (memcmp() != 0), which short-circuits on the first differing byte, so its run time depends on the number of matching leading bytes. This affects all five AEAD modes: GCM, CCM, ChaCha20Poly1305, EAX and OCB. The one-shot *_decrypt_verify helpers are unaffected; they verify the tag inside libtomcrypt with a constant-time comparison.\n\nThe timing difference is a tag-verification oracle. An attacker who can submit many candidate tags for the same nonce, ciphertext and associated data while measuring the timing precisely enough may recover the expected tag byte by byte and forge a message that verifies."}, {"lang": "es", "value": "Las versiones de CryptX anteriores a la 0.088_001 para Perl comparan las etiquetas de autenticaci\u00f3n AEAD en tiempo no constante en la ruta de descifrado por flujo decrypt_done.\n\nLa forma decrypt_done($tag) la compara con la etiqueta calculada con memNE (memcmp() != 0), que se interrumpe en el primer byte diferente, por lo que su tiempo de ejecuci\u00f3n depende del n\u00famero de bytes iniciales coincidentes. Esto afecta a los cinco modos AEAD: GCM, CCM, ChaCha20Poly1305, EAX y OCB. Las funciones auxiliares *_decrypt_verify de un solo uso no se ven afectadas; verifican la etiqueta dentro de libtomcrypt con una comparaci\u00f3n en tiempo constante.\n\nLa diferencia de tiempo es un or\u00e1culo de verificaci\u00f3n de etiquetas. Un atacante que puede enviar muchas etiquetas candidatas para el mismo nonce, texto cifrado y datos asociados mientras mide el tiempo con suficiente precisi\u00f3n puede recuperar la etiqueta esperada byte a byte y falsificar un mensaje que se verifique."}], "id": "CVE-2026-13758", "lastModified": "2026-10-25T21:10:00.770", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 1.4, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-13758", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-30T13:56:51.096991Z", "version": "2.0.3"}}]}, "published": "2026-06-29T21:16:43.067", "references": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://github.com/DCIT/perl-CryptX/commit/7e56347d420aaf43b2ee1586f4a230492ccf1642.patch"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://metacpan.org/release/MIK/CryptX-0.088_001/changes"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2026/06/29/19"}], "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-208"}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,0.088_001)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "CryptX", "source": "cna", "vendor": "MIK"}, "product": "cryptx", "vendor": "mik"}], "created": "2026-06-29T22:30:05.222969+00:00", "updated": "2026-06-30T15:45:05.217698+00:00", "vendors": ["mik", "mik$PRODUCT$cryptx"]}