CVE-2026-2474
BaseFortify
Publication date: 2026-02-16
Last updated on: 2026-03-04
Assigner: CPANSec
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ddick | crypt | From 0.41 (inc) to 0.55 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-122 | A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). |
| CWE-1284 | The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability exists in Crypt::URandom versions from 0.41 before 0.55 for Perl, specifically in the XS function crypt_urandom_getrandom(). This function does not check if the length parameter is non-negative. If a negative value is passed, an integer wraparound occurs during buffer allocation, resulting in a zero-byte buffer.
Subsequently, the function calls getrandom() with the original negative length value, which is implicitly converted to a very large unsigned number. This causes writes beyond the allocated buffer, leading to heap memory corruption and potentially crashing the application (denial of service).
While typical usage hardcodes the length parameter, reducing risk, applications that pass untrusted input to this parameter may be vulnerable to exploitation.
How can this vulnerability impact me? :
This vulnerability can lead to heap memory corruption due to buffer overflow, which may cause the affected application to crash, resulting in a denial of service.
If an attacker can supply a negative length value to the vulnerable function, they could exploit this flaw to disrupt the normal operation of the application, potentially causing instability or downtime.
However, the likelihood of exploitation is reduced if the length parameter is hardcoded and not influenced by untrusted input.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability arises from the Crypt::URandom Perl module versions 0.41 to before 0.55, specifically in the XS function crypt_urandom_getrandom() when it receives a negative length parameter. Detection involves identifying if your system or applications use these vulnerable versions of Crypt::URandom and whether untrusted input is passed to the length parameter.'}, {'type': 'paragraph', 'content': 'Since this is a heap buffer overflow triggered by a negative length parameter, direct network detection is unlikely. Instead, detection should focus on auditing Perl applications for usage of Crypt::URandom versions 0.41 to before 0.55 and checking if any calls to crypt_urandom_getrandom() pass untrusted or user-controlled input.'}, {'type': 'paragraph', 'content': 'Suggested commands to detect the vulnerable module version on your system:'}, {'type': 'list_item', 'content': 'perl -MCrypt::URandom -e \'print $Crypt::URandom::VERSION . "\\n";\''}, {'type': 'list_item', 'content': 'cpan -D Crypt::URandom'}, {'type': 'paragraph', 'content': 'To detect if any Perl scripts call crypt_urandom_getrandom() with potentially unsafe input, you can search your codebase:'}, {'type': 'list_item', 'content': "grep -r 'crypt_urandom_getrandom' /path/to/your/perl/scripts"}, {'type': 'paragraph', 'content': 'Further dynamic detection might require instrumenting or auditing the Perl applications to monitor calls to this function with negative or unexpected length parameters, but no specific commands for this are provided in the available information.'}] [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include:
- Upgrade the Crypt::URandom Perl module to version 0.55 or later, where this heap buffer overflow vulnerability is fixed.
- Audit your Perl applications to ensure that the length parameter passed to crypt_urandom_getrandom() is never negative and is not derived from untrusted input.
- If upgrading immediately is not possible, implement input validation in your application code to reject or sanitize any negative or unexpected values before they reach the vulnerable function.
- Monitor application logs and behavior for crashes or denial of service symptoms that could indicate exploitation attempts.