CVE-2026-30909

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-30909
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-30909.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-30909
Published
2026-03-08T01:15:49.387Z
Modified
2026-04-02T13:23:40.375618Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

Crypt::NaCl::Sodium versions through 2.002 for Perl has potential integer overflows.

bin2hex, encrypt, aes256gcmencryptafternm and seal functions do not check that output size will be less than SIZE_MAX, which could lead to integer wraparound causing an undersized output buffer.

Encountering this issue is unlikely as the message length would need to be very large.

For bin2hex() the binlen would have to be > SIZEMAX / 2 For encrypt() the msglen would need to be > SIZEMAX - 16U For aes256gcmencryptafternm() the msglen would need to be > SIZEMAX - 16U For seal() the enclen would need to be > SIZEMAX - 64U

References

Affected packages

Git / github.com/cpan-authors/crypt-nacl-sodium

Affected ranges

Type
GIT
Repo
https://github.com/cpan-authors/crypt-nacl-sodium
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
73bb6df47f6a8cc6955b1c3cdf8c6ac0c74dd686
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.003"
        }
    ]
}

Affected versions

2.*
2.000
2.001
2.002
v0.*
v0.01
v0.02
v0.03
v0.04
v0.05
v0.06
v0.07
v0.08
v0.09
v1.*
v1.0.6.0
v1.0.6.1
v1.0.7.0
v1.0.8.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-30909.json"