CVE-2026-41565Disclosure

LOWCVSS 7.5 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

CryptX versions before 0.088_001 for Perl have a stack buffer overflow in four AEAD decrypt_verify helpers. The gcm_decrypt_verify, ccm_decrypt_verify, chacha20poly1305_decrypt_verify and eax_decrypt_verify XS routines copied the caller-supplied authentication tag into a fixed 144-byte stack buffer (MAXBLOCKSIZE) without checking the supplied length. A longer tag overwrites the stack past the buffer. Version 0.088 added the clamp to gcm_decrypt_verify, and 0.088_001 added it to the other three. Any caller of an affected helper that forwards an attacker-controlled tag longer than the buffer can trigger the overflow.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-121

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Patch or workaround signal is available
3 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 3 signals
Disclosure: 2 classified signals
Peaked at 2 mentions on most recent observed day (2026-06-07)
3 total mentions across 2 days

Deep dive

Activity timeline3 mentions / 2d

Signal classification2 categories

Disclosure

266.7%

Patch

133.3%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-05-29	1	Disclosure1
2026-06-07	2	Disclosure1Patch1

Full discourse3 posts

Open Source Security mailing list@oss_security136d
Disclosure
Perl CPAN CVE-2026-9658: Plack::Middleware::Security::Common before 0.13.1 did not block header injections in request paths https://www.openwall.com/lists/oss-security/2026/05/28/9 CVE-2026-41565: CryptX before 0.088_001 have a stack buffer overflow in four AEAD decrypt_verify helpers https://www.openwall.com/lists/oss-security/2026/05/28/10
Post summary
Two Perl CPAN vulnerabilities are disclosed: header injection in Plack::Middleware::Security::Common prior to 0.13.1 and a stack buffer overflow in CryptX prior to 0.088_001. The post provides module, version, and flaw details but no proof of concept, exploitation, patch, or active usage information.
10010320
4.6K followersView on X
Ferramentas Linux@Cezar_H_Linux127d
Patch
GUIA COMPLETO: Como corrigir o estouro de pilha no Perl CryptX (CVE-2026-41565) no #Fedora Linux. Saiba mais : -> http://shorturl.at/HDyc8 https://t.co/OUZJTMmfH2
Post summary
The tweet promotes a comprehensive guide to patch a stack‑overflow flaw (CVE‑2026‑41565) in Perl CryptX on Fedora Linux, offering remediation steps and links.
1000073
1.5K followersView on X
ThreatCluster@threatcluster127d
Disclosure
Fedora reported stack buffer overflow vulnerability CVE-2026-41565 in the perl-CryptX package for Fedora 43 and 44 allowing arbitrary code execution via a crafted authentication tag, according to LinuxSecurity. https://threatcluster.io/cluster/critical-buffer-overflow-in-fedoras-perl-cryptx-affects-mult-29802f85
Post summary
Fedora disclosed a stack buffer overflow (CVE-2026-41565) in the perl-CryptX package that could enable arbitrary code execution through a crafted authentication tag; no exploitation or patch details were mentioned.
0000060
317 followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-41565

ThreatCluster[verified]@threatclusterDisclosure

Fedora disclosed a stack buffer overflow (CVE-2026-41565) in the perl-CryptX package that could enable arbitrary code execution through a crafted authentication tag; no exploitation or patch details were mentioned.

Open Source Security mailing list@oss_securityDisclosure

Two Perl CPAN vulnerabilities are disclosed: header injection in Plack::Middleware::Security::Common prior to 0.13.1 and a stack buffer overflow in CryptX prior to 0.088_001. The post provides module, version, and flaw details but no proof of concept, exploitation, patch, or active usage information.

Ferramentas Linux@Cezar_H_LinuxPatch

The tweet promotes a comprehensive guide to patch a stack‑overflow flaw (CVE‑2026‑41565) in Perl CryptX on Fedora Linux, offering remediation steps and links.