CVE-2026-13758

{
  "id": "CVE-2026-13758",
  "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
  "published": "2026-06-29T21:16:43.067",
  "lastModified": "2026-10-25T21:10:00.770",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "CryptX versions before 0.088_001 for Perl compare AEAD authentication tags in non-constant time in the streaming decrypt_done path.\n\nThe decrypt_done($tag) form compares it against the computed tag with memNE (memcmp() != 0), which short-circuits on the first differing byte, so its run time depends on the number of matching leading bytes. This affects all five AEAD modes: GCM, CCM, ChaCha20Poly1305, EAX and OCB. The one-shot *_decrypt_verify helpers are unaffected; they verify the tag inside libtomcrypt with a constant-time comparison.\n\nThe timing difference is a tag-verification oracle. An attacker who can submit many candidate tags for the same nonce, ciphertext and associated data while measuring the timing precisely enough may recover the expected tag byte by byte and forge a message that verifies."
    },
    {
      "lang": "es",
      "value": "Las versiones de CryptX anteriores a la 0.088_001 para Perl comparan las etiquetas de autenticación AEAD en tiempo no constante en la ruta de descifrado por flujo decrypt_done.\n\nLa forma decrypt_done($tag) la compara con la etiqueta calculada con memNE (memcmp() != 0), que se interrumpe en el primer byte diferente, por lo que su tiempo de ejecución depende del número de bytes iniciales coincidentes. Esto afecta a los cinco modos AEAD: GCM, CCM, ChaCha20Poly1305, EAX y OCB. Las funciones auxiliares *_decrypt_verify de un solo uso no se ven afectadas; verifican la etiqueta dentro de libtomcrypt con una comparación en tiempo constante.\n\nLa diferencia de tiempo es un oráculo de verificación de etiquetas. Un atacante que puede enviar muchas etiquetas candidatas para el mismo nonce, texto cifrado y datos asociados mientras mide el tiempo con suficiente precisión puede recuperar la etiqueta esperada byte a byte y falsificar un mensaje que se verifique."
    }
  ],
  "affected": [
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "affectedData": [
        {
          "vendor": "MIK",
          "product": "CryptX",
          "defaultStatus": "unaffected",
          "collectionURL": "https://cpan.org/modules",
          "packageName": "CryptX",
          "programFiles": [
            "inc/CryptX_AuthEnc_GCM.xs.inc",
            "inc/CryptX_AuthEnc_CCM.xs.inc",
            "inc/CryptX_AuthEnc_ChaCha20Poly1305.xs.inc",
            "inc/CryptX_AuthEnc_EAX.xs.inc",
            "inc/CryptX_AuthEnc_OCB.xs.inc"
          ],
          "programRoutines": [
            {
              "name": "Crypt::AuthEnc::GCM::decrypt_done"
            },
            {
              "name": "Crypt::AuthEnc::CCM::decrypt_done"
            },
            {
              "name": "Crypt::AuthEnc::ChaCha20Poly1305::decrypt_done"
            },
            {
              "name": "Crypt::AuthEnc::EAX::decrypt_done"
            },
            {
              "name": "Crypt::AuthEnc::OCB::decrypt_done"
            }
          ],
          "repo": "https://github.com/DCIT/perl-CryptX",
          "versions": [
            {
              "version": "0",
              "lessThan": "0.088_001",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "baseScore": 3.7,
          "baseSeverity": "LOW",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-30T13:56:51.096991Z",
          "id": "CVE-2026-13758",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-208"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/DCIT/perl-CryptX/commit/7e56347d420aaf43b2ee1586f4a230492ccf1642.patch",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    },
    {
      "url": "https://metacpan.org/release/MIK/CryptX-0.088_001/changes",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2026/06/29/19",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ]
}