HighFix available
libcryptx-perl — security advisory
CryptX versions before 0.088_001 for Perl have a stack buffer overflow in four AEAD decrypt_verify helpers. The gcm_decrypt_verify, ccm_decrypt_verify, chacha20poly1305_decrypt_verify and eax_decrypt_verify XS routines copied the caller-supplied authentication tag into a fixed 144-byte stack buffer (MAXBLOCKSIZE) without checking the supplied length. A longer tag overwrites the stack past the buffer. Version 0.088 added the clamp to gcm_decrypt_verify, and 0.088_001 added it to the other three. Any caller of an affected helper that forwards an attacker-controlled tag longer than the buffer can trigger the overflow.
- Products
- libcryptx-perl
- Affected versions
- 0.077-1, 0.078-1, 0.080-1, 0.080-2, 0.081-1, 0.081-2, 0.082-1, 0.082.001-1, 0.084-1, 0.085-1, 0.085-1+deb13u1, 0.087-1, 0.087-2, 0.088-1, 0.089-1, 0.090-1, 0.090-1~bpo13+1, 0.091-1
- Fixed versions
- 0.089-1
- CVEs
- CVE-2026-41565
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 17:47 UTC · Revision 2
Source evidence
CryptX versions before 0.088_001 for Perl have a stack buffer overflow in four AEAD decrypt_verify helpers. The gcm_decrypt_verify, ccm_decrypt_verify, chacha20poly1305_decrypt_verify and eax_decrypt_verify XS routines copied the caller-supplied authentication tag into a fixed 144-byte stack buffer (MAXBLOCKSIZE) without checking the supplied length. A longer tag overwrites the stack past the buffer. Version 0.088 added the clamp to gcm_decrypt_verify, and 0.088_001 added it to the other three. Any caller of an affected helper that forwards an attacker-controlled tag longer than the buffer can trigger the overflow.
osv:DEBIAN-CVE-2026-41565
libcryptx-perl
Fixed versions: Not specified
libcryptx-perl
Fixed versions: Not specified
libcryptx-perl
Fixed versions: 0.089-1
Complete source record
{
"id": "a45bbae79684e383450da368fb817dd189d2811bd72ea50abff449ed707158b0",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2026-41565",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2026-41565",
"summary": "CryptX versions before 0.088_001 for Perl have a stack buffer overflow in four AEAD decrypt_verify helpers. The gcm_decrypt_verify, ccm_decrypt_verify, chacha20poly1305_decrypt_verify and eax_decrypt_verify XS routines copied the caller-supplied authentication tag into a fixed 144-byte stack buffer (MAXBLOCKSIZE) without checking the supplied length. A longer tag overwrites the stack past the buffer. Version 0.088 added the clamp to gcm_decrypt_verify, and 0.088_001 added it to the other three. Any caller of an affected helper that forwards an attacker-controlled tag longer than the buffer can trigger the overflow.",
"evidence": "osv:DEBIAN-CVE-2026-41565",
"products": [
{
"name": {
"value": "libcryptx-perl",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.077-1",
"evidence": "/affected/0/versions"
},
{
"value": "0.078-1",
"evidence": "/affected/0/versions"
},
{
"value": "0.080-1",
"evidence": "/affected/0/versions"
},
{
"value": "0.080-2",
"evidence": "/affected/0/versions"
},
{
"value": "0.081-1",
"evidence": "/affected/0/versions"
},
{
"value": "0.081-2",
"evidence": "/affected/0/versions"
},
{
"value": "0.082-1",
"evidence": "/affected/0/versions"
},
{
"value": "0.082.001-1",
"evidence": "/affected/0/versions"
},
{
"value": "0.084-1",
"evidence": "/affected/0/versions"
},
{
"value": "0.085-1",
"evidence": "/affected/0/versions"
},
{
"value": "0.087-1",
"evidence": "/affected/0/versions"
},
{
"value": "0.087-2",
"evidence": "/affected/0/versions"
},
{
"value": "0.088-1",
"evidence": "/affected/0/versions"
},
{
"value": "0.089-1",
"evidence": "/affected/0/versions"
},
{
"value": "0.090-1",
"evidence": "/affected/0/versions"
},
{
"value": "0.090-1~bpo13+1",
"evidence": "/affected/0/versions"
},
{
"value": "0.091-1",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "libcryptx-perl",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.085-1",
"evidence": "/affected/1/versions"
},
{
"value": "0.085-1+deb13u1",
"evidence": "/affected/1/versions"
},
{
"value": "0.087-1",
"evidence": "/affected/1/versions"
},
{
"value": "0.087-2",
"evidence": "/affected/1/versions"
},
{
"value": "0.088-1",
"evidence": "/affected/1/versions"
},
{
"value": "0.089-1",
"evidence": "/affected/1/versions"
},
{
"value": "0.090-1",
"evidence": "/affected/1/versions"
},
{
"value": "0.090-1~bpo13+1",
"evidence": "/affected/1/versions"
},
{
"value": "0.091-1",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "libcryptx-perl",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0.089-1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": [
{
"value": "0.085-1",
"evidence": "/affected/2/versions"
},
{
"value": "0.087-1",
"evidence": "/affected/2/versions"
},
{
"value": "0.087-2",
"evidence": "/affected/2/versions"
},
{
"value": "0.088-1",
"evidence": "/affected/2/versions"
}
]
}
],
"severity": "high",
"structured": {
"id": "DEBIAN-CVE-2026-41565",
"aliases": [
"DEBIAN-CVE-2026-41565"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "libcryptx-perl",
"purl": "pkg:deb/debian/libcryptx-perl?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"versions": [
"0.077-1",
"0.078-1",
"0.080-1",
"0.080-2",
"0.081-1",
"0.081-2",
"0.082-1",
"0.082.001-1",
"0.084-1",
"0.085-1",
"0.087-1",
"0.087-2",
"0.088-1",
"0.089-1",
"0.090-1",
"0.090-1~bpo13+1",
"0.091-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-41565.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "libcryptx-perl",
"purl": "pkg:deb/debian/libcryptx-perl?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"versions": [
"0.085-1",
"0.085-1+deb13u1",
"0.087-1",
"0.087-2",
"0.088-1",
"0.089-1",
"0.090-1",
"0.090-1~bpo13+1",
"0.091-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-41565.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.089-1"
}
]
}
],
"package": {
"name": "libcryptx-perl",
"purl": "pkg:deb/debian/libcryptx-perl?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"0.085-1",
"0.087-1",
"0.087-2",
"0.088-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-41565.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
],
"modified": "2026-10-27T09:47:41.683496975Z",
"provider": "osv",
"upstream": [
"CVE-2026-41565"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2026-41565"
]
},
"related_cves": [
{
"value": "CVE-2026-41565",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 461208,
"published_at": "2026-05-28T16:16:22.343+00:00"
}