Live › vulnerability › CVE-2026-85783
Go to dashboardCrypt::Age before 0.004 accepts any number of recipient stanzas in an age file header and runs an X25519 scalar multiplication, HKDF and ChaCha20-Poly1305 open for each stanza against every identity held. An attacker who supplies a crafted encrypted file can drive CPU use up before decryption is rejected, causing denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications that decrypt age files they did not create, such as user uploads or files received from partners, are exposed because each attacker-chosen recipient stanza costs CPU before the file is rejected. Services that only decrypt files they wrote themselves are unlikely to be reached by this attack. Sources do not say whether the flaw is reachable through any particular network path beyond file decryption.
No product ranges from the sources yet.
perl -MCrypt::Age -e 'print $Crypt::Age::VERSION' or cpanm --info Crypt::Agedecrypt, decrypt_file or decrypt_filehandle on files from outside the team0.004 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Crypt::Age versions before 0.004 for Perl allow CPU exhaustion via an unbounded number of recipient stanzas, each costing an X25519 scalar multiplication in unwrap_file_key.
The header parser accepts any number of recipient stanzas, and unwrap_file_key tries every identity against every X25519 stanza. Each attempt runs a scalar multiplication, an HKDF and a ChaCha20-Poly1305 open. The header MAC cannot be checked first, because its key comes from the file key, which only a successful unwrap produces.
Each stanza is 98 bytes of attacker-chosen header and buys one scalar multiplication per identity held, and the file is rejected only after every one of them has run. A caller reaches this through decrypt, decrypt_file or decrypt_filehandle whenever it decrypts a file it did not write.
This page as .md · .json · in your agent: get_signal("CVE-2026-85783")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.