CVE-2026-13758

CryptX for Perl versions before 0.088_001 are affected. In the streaming decrypt_done path, the code compares the AEAD authentication tag using memNE (non-constant-time), causing runtime that depends on the number of matching leading bytes. This timing difference creates a tag-verification oracle...