CVE-2026-30909
Integer Overflow in Crypt::NaCl::Sodium Perl Functions Causing Buffer Undersize
Publication date: 2026-03-08
Last updated on: 2026-03-18
Assigner: CPANSec
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| timlegge | crypt | to 2.003 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-190 | The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-30909 is an integer overflow vulnerability in the Perl bindings of the libsodium cryptographic library, specifically in Crypt::NaCl::Sodium versions through 2.002.
Certain functions like bin2hex, encrypt, aes256gcm_encrypt_afternm, and seal do not properly check if the output size exceeds the maximum allowed size (SIZE_MAX). This can cause an integer wraparound, leading to an undersized output buffer.
If the output buffer is too small due to this overflow, it could result in memory corruption or crashes during cryptographic operations.
However, encountering this issue is unlikely because it requires processing extremely large message lengths close to system memory limits.
How can this vulnerability impact me? :
This vulnerability can lead to memory corruption or application crashes when performing cryptographic operations using the affected Perl libsodium bindings.
If exploited, it could potentially cause denial of service or unexpected behavior in applications relying on these cryptographic functions.
However, exploitation is difficult because it requires processing very large input sizes that approach system memory limits.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability arises from integer overflow issues in specific Perl functions within Crypt::NaCl::Sodium, which are triggered only with extremely large input sizes. Detection involves verifying if the affected Perl module versions are in use and checking for unusually large input sizes to the vulnerable functions.'}, {'type': 'paragraph', 'content': 'Since the issue is related to integer overflows in functions like bin2hex, encrypt, aes256gcm_encrypt_afternm, and seal, you can detect vulnerable versions by checking the installed Crypt::NaCl::Sodium Perl module version (versions through 2.002 are affected).'}, {'type': 'list_item', 'content': 'Check the installed version of Crypt::NaCl::Sodium with the command: perl -MCrypt::NaCl::Sodium -e \'print $Crypt::NaCl::Sodium::VERSION, "\\n";\''}, {'type': 'list_item', 'content': 'Audit your Perl scripts or applications for usage of the vulnerable functions: bin2hex, encrypt, aes256gcm_encrypt_afternm, and seal.'}, {'type': 'list_item', 'content': 'Monitor application logs or error messages for croak() exceptions indicating size_t overflow errors, such as "Encrypted length exceeds system memory limit (size_t overflow)" or "Binary data provided too large (will cause hex_len > SIZE_MAX)".'}] [1]
What immediate steps should I take to mitigate this vulnerability?
The primary mitigation is to update the Crypt::NaCl::Sodium Perl module to a version that includes the patch addressing this vulnerability.
- Upgrade Crypt::NaCl::Sodium to a version later than 2.002 where the integer overflow checks have been implemented.
- Ensure that input sizes to the vulnerable functions (bin2hex, encrypt, aes256gcm_encrypt_afternm, seal) are validated and kept well below the SIZE_MAX limits to avoid triggering integer wraparound.
- If upgrading immediately is not possible, implement input validation in your application code to reject or limit very large inputs to these functions.
These steps prevent undersized buffer allocations and potential memory corruption or crashes caused by integer overflow.