CVE-2026-41565: CryptX versions before 0.088_001 for Perl have a stack buffer overflow in four AEAD decrypt_verify helpers

Synopsis

Stack-based buffer overflow in CryptX (Perl) before version 0.088_001 affecting four AEAD decrypt_verify helper routines: gcm_decrypt_verify, ccm_decrypt_verify, chacha20poly1305_decrypt_verify, and eax_decrypt_verify. The flaw is reachable over the network without authentication, triggered by supplying an authentication tag longer than 144 bytes to any affected helper that forwards caller-controlled input. Successful exploitation crashes the affected service, causing a denial of service. A patched-image rebuild at version 0.088_001 is available on HarborGuard for environments running an affected version of CryptX.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The affected AEAD decrypt_verify helpers are reachable over the network, so an attacker must be able to send crafted input to an exposed service that forwards attacker-controlled tag data to one of the vulnerable routines.

• AuthenticationNot required

  No credentials or account are needed; the overflow can be triggered by any unauthenticated caller that can supply an oversized authentication tag to the affected endpoint.

• Victim interactionNot required

  No user action or social engineering is required; the attacker interacts directly with the target service.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and condition-free once the attacker can deliver a tag value longer than 144 bytes to an affected helper.

Blast Radius

• Crashes the process hosting the affected Perl application, taking the service offline for the duration of the outage.
• Any in-flight requests being processed at the time of the crash are dropped, causing data loss for those operations.
• Repeated triggering of the overflow enables a persistent denial-of-service condition against the affected service.