Integer Overflow Vulnerability in Perl's Crypt::NaCl::Sodium Library

CVE-2026-30909

What is CVE-2026-30909?

The Crypt::NaCl::Sodium library for Perl versions up to 2.002 contains a potential integer overflow vulnerability in several cryptographic functions. Specifically, the functions bin2hex, encrypt, aes256gcm_encrypt_afternm, and seal fail to validate the output size against SIZE_MAX. This oversight could lead to integer wraparound, which can result in undersized output buffers. Although triggering this vulnerability would require exceptionally large message lengths, it represents a significant risk to applications using these functions, necessitating prompt action to mitigate potential effects.

References