[<prev] [next>] [day] [month] [year] [list]
Message-ID: <94bb6667510951550cb10e1e1d57e47a@cpansec.org>
Date: Sat, 07 Mar 2026 21:21:23 -0400
From: Timothy Legge <timlegge@...nsec.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2026-30909: Crypt::NaCl::Sodium versions through 2.002 for Perl
has potential integer overflows
========================================================================
CVE-2026-30909 CPAN Security Group
========================================================================
CVE ID: CVE-2026-30909
Distribution: Crypt-NaCl-Sodium
Versions: through 2.002
MetaCPAN: https://metacpan.org/dist/Crypt-NaCl-Sodium
VCS Repo: https://github.com/cpan-authors/crypt-nacl-sodium
Crypt::NaCl::Sodium versions through 2.002 for Perl has potential
integer overflows
Description
-----------
Crypt::NaCl::Sodium versions through 2.002 for Perl has potential
integer overflows.
bin2hex, encrypt, aes256gcm_encrypt_afternm and seal functions do not
check that output size will be less than SIZE_MAX, which could lead to
integer wraparound causing an undersized output buffer.
Encountering this issue is unlikely as the message length would need to
be very large.
For bin2hex() the bin_len would have to be > SIZE_MAX / 2
For encrypt() the msg_len would need to be > SIZE_MAX - 16U
For aes256gcm_encrypt_afternm() the msg_len would need to be > SIZE_MAX
- 16U
For seal() the enc_len would need to be > SIZE_MAX - 64U
Problem types
-------------
- CWE-190 Integer Overflow or Wraparound
Solutions
---------
Upgrade to version 2.003
References
----------
https://metacpan.org/release/TIMLEGGE/Crypt-NaCl-Sodium-2.002/source/Sodium.xs#L2116
https://metacpan.org/release/TIMLEGGE/Crypt-NaCl-Sodium-2.002/source/Sodium.xs#L2310
https://metacpan.org/release/TIMLEGGE/Crypt-NaCl-Sodium-2.002/source/Sodium.xs#L3304
https://metacpan.org/release/TIMLEGGE/Crypt-NaCl-Sodium-2.002/source/Sodium.xs#L942
https://github.com/cpan-authors/crypt-nacl-sodium/pull/24.patch
https://metacpan.org/release/TIMLEGGE/Crypt-NaCl-Sodium-2.003/source/Changes
Credits
-------
Brad Barden <perlmodules@...0.org>, finder
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
