{"metadata": {"vulnerability": "CVE-2026-85783", "count": 11, "kinds": {"milestone": 4, "sighting": 1, "kev": 0, "other": 6}}, "data": [{"timestamp": "2026-09-04T16:29:19.634Z", "date_only": false, "value": "2026-09-04T16:29:19.634Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-85783", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-20T21:29:03.284Z", "date_only": false, "value": "2026-10-20T21:29:03.284Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-85783", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-20T21:29:03.284Z", "date_only": false, "value": "2026-10-20T21:29:03.284Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CPANSec", "record": "CVE-2026-85783", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-20T22:20:05Z", "date_only": false, "value": "2026-10-20T22:20:05Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-RVHP-9HPJ-RH7C", "record": "GHSA-RVHP-9HPJ-RH7C", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-20T22:20:05.470Z", "date_only": false, "value": "2026-10-20T22:20:05.470", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-85783", "record": "FKIE_CVE-2026-85783", "field": "published"}, {"timestamp": "2026-10-21T00:17:19.299Z", "date_only": false, "value": "2026-10-21T00:17:19.299Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-85783", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-21T00:17:19.299Z", "date_only": false, "value": "2026-10-21T00:17:19.299Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CVE", "record": "CVE-2026-85783", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-21T00:32:59Z", "date_only": false, "value": "2026-10-21T00:32:59Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-RVHP-9HPJ-RH7C", "record": "GHSA-RVHP-9HPJ-RH7C", "field": "published"}, {"timestamp": "2026-10-21T03:32:11Z", "date_only": false, "value": "2026-10-21T03:32:11Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-RVHP-9HPJ-RH7C", "record": "GHSA-RVHP-9HPJ-RH7C", "field": "modified"}, {"timestamp": "2026-10-21T09:03:38.585Z", "date_only": false, "value": "2026-10-21T09:03:38.585584Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117478091300664278", "record": "CVE-2026-85783", "field": "creation_timestamp", "uuid": "90366cff-c643-4168-86fd-58bbd591d7d5", "content": "CVE-2026-85783 Crypt::Age versions before 0.004 for Perl allow CPU exhaustion via an unbounded number of recipient stanzas, each costing an X25519 scalar multiplication in unwrap_file_key Crypt::Age versions before 0.004 for Perl allow CPU exhaustion via an unbounded number of recipient stanzas, each costing an X25519 scalar multiplication in unwrap_file_key.\nThe header parser accepts any number of recipient stanzas, and unwrap_file_key tries every identity against every X25519 stanza. Each attempt runs a scalar multiplication, an HKDF and a ChaCha20-Poly1305 open. The header MAC cannot be checked first, because its key comes from the file key, which only a successful unwrap produces.\nEach stanza is 98 bytes of attacker-chosen header and buys one scalar multiplication per identity held, and the file is rejected only after every one of them has run. A caller reaches this through decrypt, decrypt_file or decrypt_filehandle whenever it decrypts a file it did not write.\nhttps://www.cve.org/CVERecord?id=CVE-2026-85783https://metacpan.org/release/GETTY/Crypt-Age-0.004/changes#CVE_2026_85783#bot", "url": "https://infosec.exchange/users/cve/statuses/117478091300664278"}, {"timestamp": "2026-10-22T17:21:57.293Z", "date_only": false, "value": "2026-10-22T17:21:57.293", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-85783", "record": "FKIE_CVE-2026-85783", "field": "lastModified"}]}