CVE-2026-30909 Details
Description
Crypt::NaCl::Sodium versions through 2.002 for Perl has potential integer overflows. bin2hex, encrypt, aes256gcm_encrypt_afternm and seal functions do not check that output size will be less than SIZE_MAX, which could lead to integer wraparound causing an undersized output buffer. Encountering this issue is unlikely as the message length would need to be very large. For bin2hex() the bin_len would have to be > SIZE_MAX / 2 For encrypt() the msg_len would need to be > SIZE_MAX - 16U For aes256gcm_encrypt_afternm() the msg_len would need to be > SIZE_MAX - 16U For seal() the enc_len would need to be > SIZE_MAX - 64U
A vulnerability allowing for integer overflow has been identified in the Crypt::NaCl::Sodium Perl module, specifically in versions through 2.002. The issue arises in the bin2hex, encrypt, aes256gcm_encrypt_afternm, and seal functions, which fail to validate that the output size will remain below the maximum size limit. This oversight could result in an integer wraparound, leading to an inadequately sized output buffer. While exploitation of this vulnerability is unlikely due to the need for a very large message length, it still poses a potential risk.
Users can upgrade to Crypt::NaCl::Sodium version 2.003 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/cpan-authors/crypt-nacl-sodium/pull/24.patch | CPANSec | Patch |
| https://metacpan.org/release/TIMLEGGE/Crypt-NaCl-Sodium-2.002/source/Sodium.xs#L2116 | CPANSec | Product |
| https://metacpan.org/release/TIMLEGGE/Crypt-NaCl-Sodium-2.002/source/Sodium.xs#L2310 | CPANSec | Product |
| https://metacpan.org/release/TIMLEGGE/Crypt-NaCl-Sodium-2.002/source/Sodium.xs#L3304 | CPANSec | Product |
| https://metacpan.org/release/TIMLEGGE/Crypt-NaCl-Sodium-2.002/source/Sodium.xs#L942 | CPANSec | Product |
| https://metacpan.org/release/TIMLEGGE/Crypt-NaCl-Sodium-2.003/source/Changes | CPANSec | Release Notes |
| http://www.openwall.com/lists/oss-security/2026/03/08/1 | CVE | Mailing ListThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-190 | Integer Overflow or Wraparound | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| timlegge crypt::nacl::sodium | < 2.003 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | CPANSec |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 18, 2026 | Initial Analysis | [email protected] |
| Mar 10, 2026 | CVE Modified | CISA-ADP |
| Mar 8, 2026 | CVE Modified | CVE |
| Mar 8, 2026 | New CVE Received | CPANSec |