Integer Overflow Vulnerability in Crypt::NaCl::Sodium for Perl

CVE-2026-2588

What is CVE-2026-2588?

The Crypt::NaCl::Sodium module for Perl, specifically in versions up to 2.001, is vulnerable due to an integer overflow flaw when executing on 32-bit systems. The vulnerability arises from the improper casting of a STRLEN (size_t) to an unsigned long long when passing length pointers to libsodium functions. This discrepancy between the 32-bit size_t and the 64-bit representation of unsigned long long could potentially lead to unsafe memory operations, allowing attackers to exploit the flaw and compromise system integrity.

References