CVE-2026-41565

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-41565", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "state": "PUBLISHED", "assignerShortName": "CPANSec", "dateReserved": "2026-04-21T12:45:20.133Z", "datePublished": "2026-05-28T14:13:19.301Z", "dateUpdated": "2026-05-29T15:53:39.530Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "CryptX", "product": "CryptX", "programFiles": ["inc/CryptX_AuthEnc_GCM.xs.inc", "inc/CryptX_AuthEnc_CCM.xs.inc", "inc/CryptX_AuthEnc_ChaCha20Poly1305.xs.inc", "inc/CryptX_AuthEnc_EAX.xs.inc"], "programRoutines": [{"name": "gcm_decrypt_verify"}, {"name": "ccm_decrypt_verify"}, {"name": "chacha20poly1305_decrypt_verify"}, {"name": "eax_decrypt_verify"}], "repo": "https://github.com/DCIT/perl-CryptX", "vendor": "MIK", "versions": [{"lessThan": "0.088_001", "status": "affected", "version": "0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "CryptX versions before 0.088_001 for Perl have a stack buffer overflow in four AEAD decrypt_verify helpers.\n\nThe gcm_decrypt_verify, ccm_decrypt_verify, chacha20poly1305_decrypt_verify and eax_decrypt_verify XS routines copied the caller-supplied authentication tag into a fixed 144-byte stack buffer (MAXBLOCKSIZE) without checking the supplied length. A longer tag overwrites the stack past the buffer. Version 0.088 added the clamp to gcm_decrypt_verify, and 0.088_001 added it to the other three.\n\nAny caller of an affected helper that forwards an attacker-controlled tag longer than the buffer can trigger the overflow."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-121", "description": "CWE-121 Stack-based Buffer Overflow", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-05-28T14:13:19.301Z"}, "references": [{"tags": ["patch"], "url": "https://github.com/DCIT/perl-CryptX/commit/57e69e541b0718ca8724c2f61514322a2d859bc1.patch"}, {"tags": ["patch"], "url": "https://github.com/DCIT/perl-CryptX/commit/7e56347d420aaf43b2ee1586f4a230492ccf1642.patch"}, {"tags": ["release-notes"], "url": "https://metacpan.org/release/MIK/CryptX-0.088_001"}], "solutions": [{"lang": "en", "value": "Upgrade to CryptX 0.088_001 or later."}], "source": {"discovery": "UNKNOWN"}, "timeline": [{"lang": "en", "time": "2026-04-21T00:00:00.000Z", "value": "Issue reported."}, {"lang": "en", "time": "2026-04-23T00:00:00.000Z", "value": "Version 0.088 released with fix for gcm_decrypt_verify."}, {"lang": "en", "time": "2026-04-28T00:00:00.000Z", "value": "Version 0.088_001 released with fixes for the remaining three helpers."}], "title": "CryptX versions before 0.088_001 for Perl have a stack buffer overflow in four AEAD decrypt_verify helpers", "x_generator": {"engine": "cpansec-cna-tool 0.1"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/05/28/10"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-05-28T22:33:27.672Z"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-05-29T15:53:14.685373Z", "id": "CVE-2026-41565", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-29T15:53:39.530Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/05/28/10"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-05-28T22:33:27.672Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-41565", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-29T15:53:14.685373Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-29T15:53:33.578Z"}}], "cna": {"title": "CryptX versions before 0.088_001 for Perl have a stack buffer overflow in four AEAD decrypt_verify helpers", "source": {"discovery": "UNKNOWN"}, "affected": [{"repo": "https://github.com/DCIT/perl-CryptX", "vendor": "MIK", "product": "CryptX", "versions": [{"status": "affected", "version": "0", "lessThan": "0.088_001", "versionType": "custom"}], "packageName": "CryptX", "programFiles": ["inc/CryptX_AuthEnc_GCM.xs.inc", "inc/CryptX_AuthEnc_CCM.xs.inc", "inc/CryptX_AuthEnc_ChaCha20Poly1305.xs.inc", "inc/CryptX_AuthEnc_EAX.xs.inc"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "gcm_decrypt_verify"}, {"name": "ccm_decrypt_verify"}, {"name": "chacha20poly1305_decrypt_verify"}, {"name": "eax_decrypt_verify"}]}], "timeline": [{"lang": "en", "time": "2026-04-21T00:00:00.000Z", "value": "Issue reported."}, {"lang": "en", "time": "2026-04-23T00:00:00.000Z", "value": "Version 0.088 released with fix for gcm_decrypt_verify."}, {"lang": "en", "time": "2026-04-28T00:00:00.000Z", "value": "Version 0.088_001 released with fixes for the remaining three helpers."}], "solutions": [{"lang": "en", "value": "Upgrade to CryptX 0.088_001 or later."}], "references": [{"url": "https://github.com/DCIT/perl-CryptX/commit/57e69e541b0718ca8724c2f61514322a2d859bc1.patch", "tags": ["patch"]}, {"url": "https://github.com/DCIT/perl-CryptX/commit/7e56347d420aaf43b2ee1586f4a230492ccf1642.patch", "tags": ["patch"]}, {"url": "https://metacpan.org/release/MIK/CryptX-0.088_001", "tags": ["release-notes"]}], "x_generator": {"engine": "cpansec-cna-tool 0.1"}, "descriptions": [{"lang": "en", "value": "CryptX versions before 0.088_001 for Perl have a stack buffer overflow in four AEAD decrypt_verify helpers.\n\nThe gcm_decrypt_verify, ccm_decrypt_verify, chacha20poly1305_decrypt_verify and eax_decrypt_verify XS routines copied the caller-supplied authentication tag into a fixed 144-byte stack buffer (MAXBLOCKSIZE) without checking the supplied length. A longer tag overwrites the stack past the buffer. Version 0.088 added the clamp to gcm_decrypt_verify, and 0.088_001 added it to the other three.\n\nAny caller of an affected helper that forwards an attacker-controlled tag longer than the buffer can trigger the overflow."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-121", "description": "CWE-121 Stack-based Buffer Overflow"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-05-28T14:13:19.301Z"}}}, "cveMetadata": {"cveId": "CVE-2026-41565", "state": "PUBLISHED", "dateUpdated": "2026-05-29T15:53:39.530Z", "dateReserved": "2026-04-21T12:45:20.133Z", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "datePublished": "2026-05-28T14:13:19.301Z", "assignerShortName": "CPANSec"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "CryptX", "product": "CryptX", "programFiles": ["inc/CryptX_AuthEnc_GCM.xs.inc", "inc/CryptX_AuthEnc_CCM.xs.inc", "inc/CryptX_AuthEnc_ChaCha20Poly1305.xs.inc", "inc/CryptX_AuthEnc_EAX.xs.inc"], "programRoutines": [{"name": "gcm_decrypt_verify"}, {"name": "ccm_decrypt_verify"}, {"name": "chacha20poly1305_decrypt_verify"}, {"name": "eax_decrypt_verify"}], "repo": "https://github.com/DCIT/perl-CryptX", "vendor": "MIK", "versions": [{"lessThan": "0.088_001", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "CryptX versions before 0.088_001 for Perl have a stack buffer overflow in four AEAD decrypt_verify helpers.\n\nThe gcm_decrypt_verify, ccm_decrypt_verify, chacha20poly1305_decrypt_verify and eax_decrypt_verify XS routines copied the caller-supplied authentication tag into a fixed 144-byte stack buffer (MAXBLOCKSIZE) without checking the supplied length. A longer tag overwrites the stack past the buffer. Version 0.088 added the clamp to gcm_decrypt_verify, and 0.088_001 added it to the other three.\n\nAny caller of an affected helper that forwards an attacker-controlled tag longer than the buffer can trigger the overflow."}, {"lang": "es", "value": "Las versiones de CryptX anteriores a la 0.088_001 para Perl tienen un desbordamiento de b\u00fafer de pila en cuatro ayudantes AEAD decrypt_verify.\n\nLas rutinas XS gcm_decrypt_verify, ccm_decrypt_verify, chacha20poly1305_decrypt_verify y eax_decrypt_verify copiaban la etiqueta de autenticaci\u00f3n proporcionada por el llamador en un b\u00fafer de pila fijo de 144 bytes (MAXBLOCKSIZE) sin verificar la longitud proporcionada. Una etiqueta m\u00e1s larga sobrescribe la pila m\u00e1s all\u00e1 del b\u00fafer. La versi\u00f3n 0.088 a\u00f1adi\u00f3 el clamp a gcm_decrypt_verify, y la 0.088_001 lo a\u00f1adi\u00f3 a las otras tres.\n\nCualquier llamador de un ayudante afectado que reenv\u00ede una etiqueta controlada por el atacante m\u00e1s larga que el b\u00fafer puede desencadenar el desbordamiento."}], "id": "CVE-2026-41565", "lastModified": "2026-10-26T13:10:00.140", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41565", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-29T15:53:14.685373Z", "version": "2.0.3"}}]}, "published": "2026-05-28T16:16:22.343", "references": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://github.com/DCIT/perl-CryptX/commit/57e69e541b0718ca8724c2f61514322a2d859bc1.patch"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://github.com/DCIT/perl-CryptX/commit/7e56347d420aaf43b2ee1586f4a230492ccf1642.patch"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://metacpan.org/release/MIK/CryptX-0.088_001"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2026/05/28/10"}], "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-121"}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "type": "Secondary"}]}

{"bugzilla": {"description": "perl-CryptX: perl-CryptX: Stack buffer overflow allows arbitrary code execution via a crafted authentication tag.", "id": "2482740", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482740"}, "csaw": false, "cvss3": {"cvss3_base_score": "9.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-120", "details": ["A flaw was found in perl-CryptX. A stack buffer overflow vulnerability exists in the AEAD (Authenticated Encryption with Associated Data) decrypt_verify helper routines. An attacker who can control the length of the authentication tag provided to these routines can cause a buffer overflow, potentially leading to arbitrary code execution or a denial of service."], "name": "CVE-2026-41565", "public_date": "2026-05-28T14:13:19Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-41565\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-41565\nhttps://github.com/DCIT/perl-CryptX/commit/57e69e541b0718ca8724c2f61514322a2d859bc1.patch\nhttps://github.com/DCIT/perl-CryptX/commit/7e56347d420aaf43b2ee1586f4a230492ccf1642.patch\nhttps://metacpan.org/release/MIK/CryptX-0.088_001"], "statement": "This IMPORTANT stack buffer overflow in perl-CryptX affects four AEAD decrypt_verify helpers. Exploitation requires no authentication and can be network-accessible if applications process untrusted cryptographic input. Impact is high to confidentiality, integrity, and availability through potential arbitrary code execution. Fixed in versions 0.088 (gcm) and 0.088_001 (ccm, chacha20poly1305, eax).", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,0.088_001)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "CryptX", "source": "cna", "vendor": "MIK"}, "product": "cryptx", "vendor": "mik"}], "created": "2026-05-28T16:30:15.372150+00:00", "updated": "2026-05-29T18:00:05.807700+00:00", "vendors": ["mik", "mik$PRODUCT$cryptx"]}