{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-41565 in the wild and no public exploit code.","fix":"Upgrade to a fixed version.","what":"CVE-2026-41565 is a high-severity memory corruption vulnerability in MIK CryptX, published on 28 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-41565 and fix it if it is affected.\n\nWhat it is: CVE-2026-41565 is a high-severity memory corruption vulnerability in MIK CryptX, published on 28 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-41565 in the wild and no public exploit code.\n\nAffected product: MIK CryptX. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-41565/ (Markdown: https://insights.sbomify.com/CVE-2026-41565/index.md)","id":"CVE-2026-41565","markdown":"https://insights.sbomify.com/CVE-2026-41565/index.md","name":"CVE-2026-41565","record":{"aliases":["DEBIAN-CVE-2026-41565","GHSA-4p3p-7392-hjw4","UBUNTU-CVE-2026-41565","openSUSE-SU-2026:10968-1"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["code_execution","denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"Perl CryptX library","requires_auth":"none","summary":"A stack buffer overflow in CryptX AEAD helpers allows attackers to execute arbitrary code or cause denial of service via long authentication tags.","user_interaction":"not_required","vuln_class":"memory_corruption"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"CPANSec","cpe":[],"cvss":{"score":7.5,"severity":"high","source":"cisa-adp","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"cwes":[{"id":"CWE-121","name":"Stack-based Buffer Overflow"}],"description":"CryptX versions before 0.088_001 for Perl have a stack buffer overflow in four AEAD decrypt_verify helpers.\n\nThe gcm_decrypt_verify, ccm_decrypt_verify, chacha20poly1305_decrypt_verify and eax_decrypt_verify XS routines copied the caller-supplied authentication tag into a fixed 144-byte stack buffer (MAXBLOCKSIZE) without checking the supplied length. A longer tag overwrites the stack past the buffer. Version 0.088 added the clamp to gcm_decrypt_verify, and 0.088_001 added it to the other three.\n\nAny caller of an affected helper that forwards an attacker-controlled tag longer than the buffer can trigger the overflow.","ecosystems":["openSUSE:Tumbleweed"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"CryptX versions before 0.088_001 for Perl have a stack buffer overflow in four AEAD decrypt_verify helpers","id":"CVE-2026-41565","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"memory_corruption","year":"2026"},"n_packages":1,"n_references":3,"next":{"headline":"Apache Kvrocks: Improper permission for the APPLYBATCH command","id":"CVE-2026-41566"},"packages":[{"ecosystem":"openSUSE:Tumbleweed","fixed":["0.89.0-2.1"],"introduced":["0"],"last_affected":[],"package":"perl-CryptX","purl":"pkg:rpm/opensuse/perl-CryptX\u0026distro=openSUSE%20Tumbleweed","source":"openSUSE-SU-2026:10968-1"}],"prev":{"headline":"CryptX versions before 0.088 for Perl do not reseed the Crypt::PK PRNG state after forking","id":"CVE-2026-41564"},"products":["CryptX"],"published":"2026-05-28","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"SUSE","prefix":"openSUSE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-05-29","vendors":["MIK"]},"summary":"A stack buffer overflow in CryptX AEAD helpers allows attackers to execute arbitrary code or cause denial of service via long authentication tags.","url":"https://insights.sbomify.com/CVE-2026-41565/"}