CVE-2026-85783: Crypt::Age versions before 0.004 for Perl allow CPU exhaustion via an unbounded number of recipient stanzas, each costing an X25519 scalar multiplication in unwrap_file_key

As cited

Copy frozen at 2026-10-20 23:56 UTC (site build).

vulnerabilities

CVE-2026-85783: Crypt::Age versions before 0.004 for Perl allow CPU exhaustion via an unbounded number of recipient stanzas, each costing an X25519 scalar multiplication in unwrap_file_key

CVE-2026-85783 affects Crypt::Age for Perl versions before 0.004, allowing attackers to exhaust CPU resources through an unbounded number of recipient stanzas, each requiring an X25519 scalar multiplication during key unwrapping. The vulnerability enables a denial of service condition when processing malicious cryptographic data.

Why it matters: Perl developers and systems using Crypt::Age for encryption should upgrade to version 0.004 or later to prevent denial of service attacks from specially crafted files.

Source published

2026-10-20 21:51 UTC

First seen by Cybersecurity Tracker

2026-10-20 23:13 UTC