CVE-2026-13758

CryptX versions prior to 0.088_001 for Perl are vulnerable to a timing attack because the decrypt_done($tag) form in the streaming path compares AEAD authentication tags using memNE (memcmp() != 0). This non-constant time comparison short-circuits on the first differing byte, creating a tag-verif...