CVE-2026-13758

Name of the Vulnerable Software and Affected Versions CryptX versions prior to 0.088 001

Description CryptX for Perl performs AEAD authentication tag comparisons in non-constant time within the streaming decrypt done path. The decrypt done($tag) function utilizes memNE (based on memcmp() != 0), which terminates the comparison at the first differing byte. This behavior creates a tag-verification oracle, where the execution time depends on the number of matching leading bytes. This issue affects GCM, CCM, ChaCha20Poly1305, EAX, and OCB modes. An attacker capable of submitting numerous candidate tags for the same nonce, ciphertext, and associated data while precisely measuring timing may recover the expected tag byte by byte to forge a verifying message. One-shot * decrypt verify helpers are not affected as they use constant-time comparisons within libtomcrypt.

Recommendations Update CryptX to version 0.088 001 or later.