CVE-2026-41565

{
  "id": "CVE-2026-41565",
  "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
  "published": "2026-05-28T16:16:22.343",
  "lastModified": "2026-10-26T13:10:00.140",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "CryptX versions before 0.088_001 for Perl have a stack buffer overflow in four AEAD decrypt_verify helpers.\n\nThe gcm_decrypt_verify, ccm_decrypt_verify, chacha20poly1305_decrypt_verify and eax_decrypt_verify XS routines copied the caller-supplied authentication tag into a fixed 144-byte stack buffer (MAXBLOCKSIZE) without checking the supplied length. A longer tag overwrites the stack past the buffer. Version 0.088 added the clamp to gcm_decrypt_verify, and 0.088_001 added it to the other three.\n\nAny caller of an affected helper that forwards an attacker-controlled tag longer than the buffer can trigger the overflow."
    },
    {
      "lang": "es",
      "value": "Las versiones de CryptX anteriores a la 0.088_001 para Perl tienen un desbordamiento de búfer de pila en cuatro ayudantes AEAD decrypt_verify.\n\nLas rutinas XS gcm_decrypt_verify, ccm_decrypt_verify, chacha20poly1305_decrypt_verify y eax_decrypt_verify copiaban la etiqueta de autenticación proporcionada por el llamador en un búfer de pila fijo de 144 bytes (MAXBLOCKSIZE) sin verificar la longitud proporcionada. Una etiqueta más larga sobrescribe la pila más allá del búfer. La versión 0.088 añadió el clamp a gcm_decrypt_verify, y la 0.088_001 lo añadió a las otras tres.\n\nCualquier llamador de un ayudante afectado que reenvíe una etiqueta controlada por el atacante más larga que el búfer puede desencadenar el desbordamiento."
    }
  ],
  "affected": [
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "affectedData": [
        {
          "vendor": "MIK",
          "product": "CryptX",
          "defaultStatus": "unaffected",
          "collectionURL": "https://cpan.org/modules",
          "packageName": "CryptX",
          "programFiles": [
            "inc/CryptX_AuthEnc_GCM.xs.inc",
            "inc/CryptX_AuthEnc_CCM.xs.inc",
            "inc/CryptX_AuthEnc_ChaCha20Poly1305.xs.inc",
            "inc/CryptX_AuthEnc_EAX.xs.inc"
          ],
          "programRoutines": [
            {
              "name": "gcm_decrypt_verify"
            },
            {
              "name": "ccm_decrypt_verify"
            },
            {
              "name": "chacha20poly1305_decrypt_verify"
            },
            {
              "name": "eax_decrypt_verify"
            }
          ],
          "repo": "https://github.com/DCIT/perl-CryptX",
          "versions": [
            {
              "version": "0",
              "lessThan": "0.088_001",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-29T15:53:14.685373Z",
          "id": "CVE-2026-41565",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-121"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/DCIT/perl-CryptX/commit/57e69e541b0718ca8724c2f61514322a2d859bc1.patch",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    },
    {
      "url": "https://github.com/DCIT/perl-CryptX/commit/7e56347d420aaf43b2ee1586f4a230492ccf1642.patch",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    },
    {
      "url": "https://metacpan.org/release/MIK/CryptX-0.088_001",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2026/05/28/10",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ]
}