CVE-2026-13758: CryptX Perl Timing Side-Channel in AEAD Tag Verification

Technical summary

CVE-2026-13758 describes a timing side-channel in CryptX's AEAD tag verification pathway. The vulnerability resides in the streaming decrypt_done($tag) interface, which compares the supplied tag against the internally computed tag using memcmp()-style non-constant-time comparison via the memNE function. This comparison short-circuits on the first mismatched byte, causing execution time to vary based on the number of leading matching bytes in the tag. The vulnerability affects all five AEAD cipher modes implemented in CryptX: GCM, CCM, ChaCha20Poly1305, EAX, and OCB. The one-shot *_decrypt_verify helper functions are not vulnerable because they perform tag verification within the underlying libtomcrypt library using constant-time operations. Remediation requires upgrading to CryptX version 0.088_001 or later.

Business impact

The timing oracle enables message forgery attacks against applications using CryptX's streaming AEAD decryption in scenarios where an attacker can submit many candidate tags and measure response timing with microsecond precision. Compromise of message authenticity undermines the security guarantee of authenticated encryption, potentially allowing undetected tampering with sensitive data. The practical impact depends on deployment context: applications processing high volumes of decryption requests from untrusted sources with tight timing constraints face higher risk. Systems using the one-shot decryption functions, or those where timing measurements are difficult to obtain (high latency networks, isolated environments), face lower real-world risk.

Affected systems

CryptX Perl module versions prior to 0.088_001 are affected. All five AEAD modes are vulnerable in the streaming decrypt_done() path. Applications explicitly using the streaming interface with user-supplied tags are at risk; those relying on the *_decrypt_verify one-shot functions are not affected. The vulnerability does not require special Perl versions or platform-specific configurations—any environment running vulnerable CryptX versions may be affected.

Exploitability

Exploiting this vulnerability requires specific conditions: the attacker must be able to submit multiple decryption requests with varying authentication tags against the same nonce and ciphertext, must have precise timing measurement capabilities (microsecond-level precision), and must be able to iterate through candidate tags in a controlled manner. The attack becomes practical only in high-request-rate scenarios or where timing variance is easily measurable (e.g., local network, direct API access). CVSS 3.7 (Low) reflects the high barrier to exploitation: non-networked proximity or administrative access may be required for sufficiently precise timing measurement, and the attacker must already know the plaintext or have other means to construct valid candidate messages.

Remediation

Upgrade CryptX to version 0.088_001 or later. Organizations should audit their usage of the decrypt_done() streaming interface and prioritize patching applications handling high volumes of authenticated decryption from untrusted sources. If immediate upgrade is not feasible, consider replacing streaming AEAD usage with the one-shot *_decrypt_verify functions, which use constant-time comparison internally.

Patch guidance

Verify the installed CryptX version via the Perl module management tools (e.g., 'perl -MCryptX -e print $CryptX::VERSION'). Update using your standard Perl module update mechanism (CPAN, package manager, or manual download from CPAN). After patching, verify the new version is loaded by restarting any running applications that depend on CryptX. Consult the CryptX release notes for version 0.088_001 to confirm the timing vulnerability fix is included in your build.

Detection guidance

Review application source code for calls to decrypt_done() in CryptX usage. Identify which AEAD modes (GCM, CCM, ChaCha20Poly1305, EAX, OCB) are invoked through the streaming interface. Monitor the CryptX version in use via module introspection. If timing-sensitive telemetry is available (request response times), unusual patterns in authentication failure timing may indicate exploitation attempts, though this detection method is difficult in practice. Organizations should focus on inventory and prioritization rather than behavioral detection.

Why prioritize this

Although rated CVSS 3.7 (Low), this vulnerability should not be dismissed. It represents a cryptographic weakness—specifically, a break of the authenticated encryption security model—even if exploitation is constrained to specific scenarios. Organizations with sensitive data requiring authenticated encryption should treat this as a medium-priority patch window item, especially if they use the streaming interface. Standard software hygiene and regular dependency updates make this a natural candidate for inclusion in routine maintenance cycles.

Risk score, explained

The CVSS 3.1 score of 3.7 (Low) reflects a Low severity rating based on attack complexity (High), confidentiality impact (Low—the tag itself is leaked, not plaintext), and lack of integrity or availability impact in the standard model. However, CVSS does not fully capture the cryptographic significance of breaking constant-time comparison in authenticated encryption. The scoring emphasizes that exploitation requires precise timing measurement and many decryption attempts, limiting the practical attack surface. Organizations should weigh this against their threat model and the criticality of authenticated encryption in their environment.

Frequently asked questions