Cyber ·
CVE-2026-85783: Crypt::Age for Perl before 0.004 allows CPU exhaustion
Security advisory published on October 20, 2026 describes a flaw in the Crypt::Age Perl library, in versions before 0.004, that can consume CPU because it accepts an unlimited number of recipient blocks.
CVE-2026-85783 was published by the CPAN Security Group and shared on the oss-sec list by Robert Rothenberg on October 20, 2026. The affected distribution is Crypt-Age, in versions before 0.004. According to the available text, the library can consume excessive CPU because it accepts an unlimited number of recipient blocks, which describes a resource exhaustion flaw. The content received is an automatic translation of an advisory originally written in English, so further technical details, such as exact exploitation conditions and severity scoring, should be checked in the original source. To verify the advisory, consult the official text on the oss-sec list, the distribution page on MetaCPAN, and the code repository named in the advisory. Teams using this Perl library should identify whether it is present in their systems, including as an indirect dependency, and update to version 0.004 or later when possible. Rota Nacional does not patch third-party libraries and does not claim to solve this engineering problem; this item is shared only as security information.