CryptX versions prior to 0.088_001 for Perl perform AEAD authentication tag comparison in the streaming decrypt_done path using memcmp(), which short-circuits on the first differing byte. This results in a timing discrepancy (CWE-208) that can be exploited as a tag-verification oracle. The vulnerability affects all five AEAD modes supported by CryptX (GCM, CCM, ChaCha20Poly1305, EAX, OCB). The one-shot decrypt_verify functions are unaffected as they use constant-time verification inside libtomcrypt. An attacker with the ability to submit many candidate tags for the same nonce, ciphertext, and associated data and measure timing precisely may recover the expected tag byte-by-byte and forge a valid message. No official patch or remediation level is provided in the advisory data.

The vulnerability allows an attacker to exploit timing differences during AEAD tag verification to recover the authentication tag byte-by-byte. This can lead to message forgery for the affected streaming decrypt_done function. However, the impact is limited by the attack complexity, requiring precise timing measurements and multiple attempts. The one-shot decrypt_verify helpers remain secure. The CVSS score of 3.7 reflects a low severity impact with no direct confidentiality, integrity, or availability compromise without significant attacker effort.

No official patch or remediation guidance is currently available. Users should avoid using the streaming decrypt_done($tag) function for AEAD tag verification in CryptX versions before 0.088_001. Instead, use the one-shot *_decrypt_verify helpers which perform constant-time tag verification. Monitor the vendor's advisory channels for updates or patches addressing this timing side-channel vulnerability.