Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-85783— Crypt::Age versions before 0.004 for Perl allow CPU exhaustion via an unbounded number of recipient stanzas, each costing an X25519 scalar multiplication in unwrap_file_key

Quick assessment

Affected
CVE-2026-85783
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Perl 的 Crypt::Age 模块在 0.004 版本之前存在 CPU 耗尽漏洞：攻击者可通过构造包含无限制数量的接收者字段（recipient stanzas）的文件，触发 函数中对每个字段执行一次 X25519 标量乘法运算。 该漏洞的成因在于：头部解析器接受任意数量的接收者字段，而 会尝试用每个密钥身份去匹配每一个 X25519 字段。每次尝试均包含一次标量乘法、一次 HKDF 密钥派生以及一次 ChaCha20-Poly1305 解密验证。由于头部消息认证码（MAC）的密钥来源于文件密钥，而文件密钥只

AI Predicted 5.9 Difficulty: Easy

Possible ATT&CK Techniques 1 AI

T1499 · Endpoint Denial of Service

I. Basic Information for CVE-2026-85783

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Crypt::Age versions before 0.004 for Perl allow CPU exhaustion via an unbounded number of recipient stanzas, each costing an X25519 scalar multiplication in unwrap_file_key
Source: CVE Program / CVE List V5
Vulnerability Description
Crypt::Age versions before 0.004 for Perl allow CPU exhaustion via an unbounded number of recipient stanzas, each costing an X25519 scalar multiplication in unwrap_file_key. The header parser accepts any number of recipient stanzas, and unwrap_file_key tries every identity against every X25519 stanza. Each attempt runs a scalar multiplication, an HKDF and a ChaCha20-Poly1305 open. The header MAC cannot be checked first, because its key comes from the file key, which only a successful unwrap produces. Each stanza is 98 bytes of attacker-chosen header and buys one scalar multiplication per identity held, and the file is rejected only after every one of them has run. A caller reaches this through decrypt, decrypt_file or decrypt_filehandle whenever it decrypts a file it did not write.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
不加限制或调节的资源分配
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
- - 0 ~ 0.004 -

II. Public POCs for CVE-2026-85783

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-85783

请登录查看更多情报信息。

Other References for CVE-2026-85783 (1)

IV. Related Vulnerabilities

Same weakness: CWE-770

V. Comments for CVE-2026-85783

No comments yet

Leave a comment