SZB-ca36b7a871
Crypt::Age CPU exhaustion flaw tracked as EUVD-2026-106854
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- Crypt::Age
- Product
- Crypt::Age
- First seen
Summary
EUVD-2026-106854, published 2026-10-20 and updated 2026-10-30, describes a CPU exhaustion flaw in Crypt::Age versions before 0.004 for Perl. The entry assigns a CVSS v3.1 score of 7.5/10.
If you use Crypt::Age
Upgrade Crypt::Age to version 0.004 or later
Limit or reject encrypted files with an unusually large number of recipient stanzas until patched
What the sources say 1
· Mastodon: “Crypt::Age versions before 0.004 for Perl allow CPU exhaustion via an unbounded number of recipient stanzas, each costing an X25519 scalar multiplication in unwrap_file_key.” Source