========================================================================
CVE-2026-30909 CPAN Security Group
========================================================================
CVE ID: CVE-2026-30909
Distribution: Crypt-NaCl-Sodium
Versions: through 2.002
MetaCPAN: https://metacpan.org/dist/Crypt-NaCl-Sodium
VCS Repo: https://github.com/cpan-authors/crypt-nacl-sodium
Crypt::NaCl::Sodium versions through 2.002 for Perl has potential
integer overflows
Description
-----------
Crypt::NaCl::Sodium versions through 2.002 for Perl has potential
integer overflows.
bin2hex, encrypt, aes256gcm_encrypt_afternm and seal functions do not
check that output size will be less than SIZE_MAX, which could lead to
integer wraparound causing an undersized output buffer.
Encountering this issue is unlikely as the message length would need to
be very large.
For bin2hex() the bin_len would have to be > SIZE_MAX / 2
For encrypt() the msg_len would need to be > SIZE_MAX - 16U
For aes256gcm_encrypt_afternm() the msg_len would need to be > SIZE_MAX
- 16U
For seal() the enc_len would need to be > SIZE_MAX - 64U
Problem types
-------------
- CWE-190 Integer Overflow or Wraparound
Solutions
---------
Upgrade to version 2.003
References
----------
https://metacpan.org/release/TIMLEGGE/Crypt-NaCl-Sodium-2.002/source/Sodium.xs#L2116
https://metacpan.org/release/TIMLEGGE/Crypt-NaCl-Sodium-2.002/source/Sodium.xs#L2310
https://metacpan.org/release/TIMLEGGE/Crypt-NaCl-Sodium-2.002/source/Sodium.xs#L3304
https://metacpan.org/release/TIMLEGGE/Crypt-NaCl-Sodium-2.002/source/Sodium.xs#L942
https://github.com/cpan-authors/crypt-nacl-sodium/pull/24.patch
https://metacpan.org/release/TIMLEGGE/Crypt-NaCl-Sodium-2.003/source/Changes
Credits
-------
Brad Barden <[email protected]>, finder
