========================================================================
CVE-2026-13758                                       CPAN Security Group
========================================================================

        CVE ID:  CVE-2026-13758
  Distribution:  CryptX
      Versions:  before 0.088_001

      MetaCPAN:  https://metacpan.org/dist/CryptX
      VCS Repo:  https://github.com/DCIT/perl-CryptX

CryptX versions before 0.088_001 for Perl compare AEAD authentication
tags in non-constant time in the streaming decrypt_done path

Description
-----------
CryptX versions before 0.088_001 for Perl compare AEAD authentication
tags in non-constant time in the streaming decrypt_done path.

The decrypt_done($tag) form compares it against the computed tag with
memNE (memcmp() != 0), which short-circuits on the first differing
byte, so its run time depends on the number of matching leading bytes.
This affects all five AEAD modes: GCM, CCM, ChaCha20Poly1305, EAX and
OCB. The one-shot *_decrypt_verify helpers are unaffected; they verify
the tag inside libtomcrypt with a constant-time comparison.

The timing difference is a tag-verification oracle. An attacker who can
submit many candidate tags for the same nonce, ciphertext and
associated data while measuring the timing precisely enough may recover
the expected tag byte by byte and forge a message that verifies.

Problem types
-------------
- CWE-208 Observable Timing Discrepancy

Solutions
---------
Upgrade to CryptX 0.088_001 or later.

References
----------
https://github.com/DCIT/perl-CryptX/commit/7e56347d420aaf43b2ee1586f4a230492ccf1642.patch
https://metacpan.org/release/MIK/CryptX-0.088_001/changes