{"id":"CVE-2026-85783","kind":"vulnerability","aliases":["CVE-2026-85783"],"related":[],"title":"Crypt::Age for Perl: unbounded recipient stanzas exhaust CPU during decryption","description":"Crypt::Age versions before 0.004 for Perl allow CPU exhaustion via an unbounded number of recipient stanzas, each costing an X25519 scalar multiplication in unwrap_file_key.\n\nThe header parser accepts any number of recipient stanzas, and unwrap_file_key tries every identity against every X25519 stanza. Each attempt runs a scalar multiplication, an HKDF and a ChaCha20-Poly1305 open. The header MAC cannot be checked first, because its key comes from the file key, which only a successful unwrap produces.\n\nEach stanza is 98 bytes of attacker-chosen header and buys one scalar multiplication per identity held, and the file is rejected only after every one of them has run. A caller reaches this through decrypt, decrypt_file or decrypt_filehandle whenever it decrypts a file it did not write.","summary":"Crypt::Age before 0.004 accepts any number of recipient stanzas in an age file header and runs an X25519 scalar multiplication, HKDF and ChaCha20-Poly1305 open for each stanza against every identity held. An attacker who supplies a crafted encrypted file can drive CPU use up before decryption is rejected, causing denial of service.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cpan","crypt-age","package","perl"],"not_affected_if":["decrypts-only-own-files"],"how_to_check":"- Check the installed Crypt::Age version with `perl -MCrypt::Age -e 'print $Crypt::Age::VERSION'` or `cpanm --info Crypt::Age`\n- Find code that calls `decrypt`, `decrypt_file` or `decrypt_filehandle` on files from outside the team","fix":"- Upgrade Crypt::Age to `0.004` or later\n- Until upgraded, only decrypt age files the team itself wrote, or limit input size and run decryption under a CPU time limit","status":"open","published_at":"2026-10-20T22:20:05+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","triaged_at":"2026-10-25T05:04:09+00:00","updated_at":"2026-10-25T05:04:09+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T05:04:09Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Crypt::Age to `0.004` or later\n- Until upgraded, only decrypt age files the team itself wrote, or limit input size and run decryption under a CPU time limit","reach":"unknown","title":"Crypt::Age for Perl: unbounded recipient stanzas exhaust CPU during decryption","impact":"low","summary":"Crypt::Age before 0.004 accepts any number of recipient stanzas in an age file header and runs an X25519 scalar multiplication, HKDF and ChaCha20-Poly1305 open for each stanza against every identity held. An attacker who supplies a crafted encrypted file can drive CPU use up before decryption is rejected, causing denial of service.","category":"package","nicknames":[],"who_cares":["perl","crypt-age","cpan"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker exhausts CPU and stalls decryption service","analyst_note":"","how_to_check":"- Check the installed Crypt::Age version with `perl -MCrypt::Age -e 'print $Crypt::Age::VERSION'` or `cpanm --info Crypt::Age`\n- Find code that calls `decrypt`, `decrypt_file` or `decrypt_filehandle` on files from outside the team","needs_analyst":false,"not_affected_if":["decrypts-only-own-files"],"who_is_affected":"Applications that decrypt age files they did not create, such as user uploads or files received from partners, are exposed because each attacker-chosen recipient stanza costs CPU before the file is rejected. Services that only decrypt files they wrote themselves are unlikely to be reached by this attack. Sources do not say whether the flaw is reachable through any particular network path beyond file decryption.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000674,"input_tokens":3503,"output_tokens":647,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-85783':14A,17A '0.004':27B,83C '98':164C 'accept':28B,109C 'age':2A,21B,25B,36B,80C 'allow':86C 'attack':59B,168C 'attacker-chosen':167C 'attempt':127C 'buy':172C 'byte':165C 'caller':193C 'cannot':143C 'caus':75B 'chacha20':48B,137C 'chacha20-poly1305':47B,136C 'check':145C 'chosen':169C 'come':150C 'cost':97C 'cpan':18B 'cpu':9A,68B,87C 'craft':63B 'crypt':1A,20B,24B,79C 'crypt-ag':19B 'cve':12A,15A 'decrypt':11A,72B,197C,198C,201C,205C 'denial':76B 'drive':67B 'encrypt':64B 'everi':55B,120C,123C,186C 'exhaust':8A,88C 'file':37B,65B,104C,117C,153C,181C,199C,207C 'filehandl':202C 'first':146C 'header':38B,107C,141C,170C 'held':57B,178C 'hkdf':45B,133C 'ident':56B,121C,177C 'key':105C,118C,149C,154C 'mac':142C 'multipl':44B,101C,131C,175C 'number':30B,92C,111C 'one':173C,187C 'open':50B,139C 'packag':22B 'parser':108C 'per':176C 'perl':4A,23B,85C 'poly1305':49B,138C 'produc':160C 'reach':194C 'recipi':6A,32B,94C,113C 'reject':74B,183C 'run':40B,128C,191C 'scalar':43B,100C,130C,174C 'servic':78B 'stanza':7A,33B,53B,95C,114C,125C,162C 'success':158C 'suppli':61B 'tri':119C 'unbound':5A,91C 'unwrap':103C,116C,159C 'use':69B 'version':81C 'via':89C 'whenev':203C 'write':211C 'x25519':42B,99C,124C","nicknames":[],"mitigations":[],"who_affected":"Applications that decrypt age files they did not create, such as user uploads or files received from partners, are exposed because each attacker-chosen recipient stanza costs CPU before the file is rejected. Services that only decrypt files they wrote themselves are unlikely to be reached by this attack. Sources do not say whether the flaw is reachable through any particular network path beyond file decryption.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:05+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-85783","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85783","severity":null,"published_at":"2026-10-20T22:20:05+00:00","modified_at":"2026-10-22T17:21:57+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}