CVE-2026-30909
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedCrypt::NaCl::Sodium versions through 2.002 for Perl has potential integer overflows. bin2hex, encrypt, aes256gcm_encrypt_afternm and seal functions do not check that output size will be less than SIZE_MAX, which could lead to integer wraparound causing an undersized output buffer. Encountering this issue is unlikely as the message length would need to be very large. For bin2hex() the bin_len would have to be > SIZE_MAX / 2 For encrypt() the msg_len would need to be > SIZE_MAX - 16U For aes256gcm_encrypt_afternm() the msg_len would need to be > SIZE_MAX - 16U For seal() the enc_len would need to be > SIZE_MAX - 64U
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceInteger overflow vulnerability in Crypt::NaCl::Sodium Perl library where bin2hex, encrypt, aes256gcm_encrypt_afternm, and seal functions fail to validate that computed output buffer sizes exceed SIZE_MAX, causing wraparound and undersized buffer allocation leading to potential heap buffer overflows during write operations.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.
NVD · CPE data< 2.003CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Check if Crypt::NaCl::Sodium is installedRun 'perl -MCrypt::NaCl::Sodium -e 'print $Crypt::NaCl::Sodium::VERSION'" or list installed Perl modules with 'cpan -l | grep -i Crypt-NaCl-Sodium'Affected if The module is not installed or cannot be loaded, then the vulnerability does not apply to your environment
-
Determine installed version of Crypt::NaCl::SodiumRun 'perl -MCrypt::NaCl::Sodium -e 'print $Crypt::NaCl::Sodium::VERSION'' to print the version numberAffected if Version is less than 2.003, meaning the installed version is affected by the integer overflow vulnerability
-
Identify code using affected functionsSearch Perl source files for calls to bin2hex, encrypt, aes256gcm_encrypt_afternm, or seal methods from Crypt::NaCl::Sodium using grep: 'grep -r "bin2hex\|encrypt\|aes256gcm_encrypt_afternm\|seal" *.pl *.pm'Affected if Code uses any of these four functions with large inputs that could trigger SIZE_MAX wraparound during buffer size calculation
-
Review input sizes processed by affected functionsExamine application code and logs to determine if messages or buffers processed by the four vulnerable functions could approach or exceed SIZE_MAX in size (typically near 2^64 bytes on 64-bit systems)Affected if Application processes input sizes that could cause integer wraparound when calculating output buffer sizes for these functions
Your environment is affected if Crypt::NaCl::Sodium version is installed and is less than 2.003, AND your code uses any of the bin2hex, encrypt, aes256gcm_encrypt_afternm, or seal functions with inputs large enough to trigger SIZE_MAX wraparound during buffer allocation calculations.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scoped2.003
Apply upstream patch when available; implement input validation to reject message lengths exceeding SIZE_MAX minus function-specific overhead before calling these functions; avoid processing extremely large messages with affected functions until fixed.
Crypt::NaCl::Sodium version 2.003
- Verify current installed version of Crypt::NaCl::Sodium by running: perl -MCrypt::NaCl::Sodium -e 'print $Crypt::NaCl::Sodium::VERSION'
- Upgrade the Crypt::NaCl::Sodium Perl module to version 2.003 or later using your CPAN client
- If using cpanm: cpanm Crypt::NaCl::Sodium>=2.003
- If using cpan: cpan> install Crypt::NaCl::Sodium version 2.003
- Verify the new version is installed: perl -MCrypt::NaCl::Sodium -e 'print $Crypt::NaCl::Sodium::VERSION'
- Review your application code to ensure any calls to bin2hex(), encrypt(), aes256gcm_encternm(), or seal() with large inputs are properly handled
Generated from the published advisory — verify against the referenced sources before acting.
- Consultation2.0 h
- Implementation4.0 h
- Testing3.0 h
- Review / QA1.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $2,800.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2026-30909 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2026-30909 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data