CVE-2026-30909: Crypt::NaCl::Sodium versions through 2.002 for Perl has potential integer overflows
Crypt::NaCl::Sodium versions through 2.002 for Perl has potential integer overflows.
bin2hex, encrypt, aes256gcmencryptafternm and seal functions do not check that output size will be less than SIZEMAX, which could lead to integer wraparound causing an undersized output buffer.
Encountering this issue is unlikely as the message length would need to be very large.
For bin2hex() the binlen would have to be > SIZEMAX / 2 For encrypt() the msglen would need to be > SIZEMAX - 16U For aes256gcmencryptafternm() the msglen would need to be > SIZEMAX - 16U For seal() the enclen would need to be > SIZEMAX - 64U
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2026-30909?
The severity of CVE-2026-30909 is considered moderate due to potential integer overflows that could lead to buffer overflows.
How do I fix CVE-2026-30909?
To fix CVE-2026-30909, upgrade to a version of Crypt::NaCl::Sodium that is greater than 2.002.
What functions are affected by CVE-2026-30909?
The affected functions in CVE-2026-30909 include bin2hex, encrypt, aes256gcm_encrypt_afternm, and seal.
What can happen if I am using a vulnerable version of Crypt::NaCl::Sodium due to CVE-2026-30909?
Using a vulnerable version can lead to possible integer overflows, increasing the risk of exploits such as denial of service or execution of arbitrary code.
Is CVE-2026-30909 present in versions after 2.002 of Crypt::NaCl::Sodium?
No, CVE-2026-30909 is not present in versions of Crypt::NaCl::Sodium after 2.002.