CVE-2026-85783: Crypt::Age versions before 0.004 for Perl allow CPU exhaustion via an unbounded number of recipient stanzas, each costing an X25519 scalar multiplication in unwrap_file_key

Q: Who is exposed to this denial-of-service issue?

Applications using Crypt::Age before 0.004 are exposed when they decrypt files they did not write, including through decrypt, decrypt_file, or decrypt_filehandle. The cost increases with the number of identities held by the decrypting application.

Q: What does an attacker need to exploit it?

An attacker needs to supply a crafted encrypted file with a large number of recipient stanzas. Each 98-byte attacker-controlled stanza causes processing for every identity during file-key unwrapping.

Q: Are files rejected before the expensive work occurs?

No. The header MAC cannot be checked before a file key is successfully unwrapped, so the implementation processes all applicable recipient stanzas before rejecting the file.

Q: What version addresses the issue?

Crypt::Age version 0.004 addresses the issue; versions before 0.004 are affected.

Published Oct 20, 2026

Updated

Crypt::Age versions before 0.004 for Perl allow CPU exhaustion via an unbounded number of recipient stanzas, each costing an X25519 scalar multiplication in unwrapfilekey.

The header parser accepts any number of recipient stanzas, and unwrapfilekey tries every identity against every X25519 stanza. Each attempt runs a scalar multiplication, an HKDF and a ChaCha20-Poly1305 open. The header MAC cannot be checked first, because its key comes from the file key, which only a successful unwrap produces.

Each stanza is 98 bytes of attacker-chosen header and buys one scalar multiplication per identity held, and the file is rejected only after every one of them has run. A caller reaches this through decrypt, decryptfile or decryptfilehandle whenever it decrypts a file it did not write.

Affected Software

1 affected component

cpan/Crypt::Age<0.004

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Crypt::Age to a version that resolves this vulnerability.
Fixed in 0.004

Event History

Oct 20, 2026

CVE Published

via MITRE·09:29 PM

Data Sourced

via MITRE·09:29 PM

RemedyDescriptionWeakness

Frequently Asked Questions

Who is exposed to this denial-of-service issue?

Applications using Crypt::Age before 0.004 are exposed when they decrypt files they did not write, including through decrypt, decrypt_file, or decrypt_filehandle. The cost increases with the number of identities held by the decrypting application.

What does an attacker need to exploit it?

An attacker needs to supply a crafted encrypted file with a large number of recipient stanzas. Each 98-byte attacker-controlled stanza causes processing for every identity during file-key unwrapping.

Are files rejected before the expensive work occurs?

No. The header MAC cannot be checked before a file key is successfully unwrapped, so the implementation processes all applicable recipient stanzas before rejecting the file.

What version addresses the issue?

Crypt::Age version 0.004 addresses the issue; versions before 0.004 are affected.

CVE-2026-85783: Crypt::Age versions before 0.004 for Perl allow CPU exhaustion via an unbounded number of recipient stanzas, each costing an X25519 scalar multiplication in unwrap_file_key

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this denial-of-service issue?

What does an attacker need to exploit it?

Are files rejected before the expensive work occurs?

What version addresses the issue?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this denial-of-service issue?

What does an attacker need to exploit it?

Are files rejected before the expensive work occurs?

What version addresses the issue?