Executive Summary

CVE-2026-30909 is an integer overflow vulnerability in the Perl bindings of the libsodium cryptographic library, specifically in Crypt::NaCl::Sodium versions through 2.002.

Certain functions like bin2hex, encrypt, aes256gcm_encrypt_afternm, and seal do not properly check if the output size exceeds the maximum allowed size (SIZE_MAX). This can cause an integer wraparound, leading to an undersized output buffer.

If the output buffer is too small due to this overflow, it could result in memory corruption or crashes during cryptographic operations.

However, encountering this issue is unlikely because it requires processing extremely large message lengths close to system memory limits.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to memory corruption or application crashes when performing cryptographic operations using the affected Perl libsodium bindings.

If exploited, it could potentially cause denial of service or unexpected behavior in applications relying on these cryptographic functions.

However, exploitation is difficult because it requires processing very large input sizes that approach system memory limits.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': 'This vulnerability arises from integer overflow issues in specific Perl functions within Crypt::NaCl::Sodium, which are triggered only with extremely large input sizes. Detection involves verifying if the affected Perl module versions are in use and checking for unusually large input sizes to the vulnerable functions.'}, {'type': 'paragraph', 'content': 'Since the issue is related to integer overflows in functions like bin2hex, encrypt, aes256gcm_encrypt_afternm, and seal, you can detect vulnerable versions by checking the installed Crypt::NaCl::Sodium Perl module version (versions through 2.002 are affected).'}, {'type': 'list_item', 'content': 'Check the installed version of Crypt::NaCl::Sodium with the command: perl -MCrypt::NaCl::Sodium -e \'print $Crypt::NaCl::Sodium::VERSION, "\\n";\''}, {'type': 'list_item', 'content': 'Audit your Perl scripts or applications for usage of the vulnerable functions: bin2hex, encrypt, aes256gcm_encrypt_afternm, and seal.'}, {'type': 'list_item', 'content': 'Monitor application logs or error messages for croak() exceptions indicating size_t overflow errors, such as "Encrypted length exceeds system memory limit (size_t overflow)" or "Binary data provided too large (will cause hex_len > SIZE_MAX)".'}] [1]

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation is to update the Crypt::NaCl::Sodium Perl module to a version that includes the patch addressing this vulnerability.

• Upgrade Crypt::NaCl::Sodium to a version later than 2.002 where the integer overflow checks have been implemented.
• Ensure that input sizes to the vulnerable functions (bin2hex, encrypt, aes256gcm_encrypt_afternm, seal) are validated and kept well below the SIZE_MAX limits to avoid triggering integer wraparound.
• If upgrading immediately is not possible, implement input validation in your application code to reject or limit very large inputs to these functions.

These steps prevent undersized buffer allocations and potential memory corruption or crashes caused by integer overflow.

Useful 0 Not Useful 0