CVE-2026-30909 identifies an integer overflow vulnerability in the Crypt::NaCl::Sodium Perl module, specifically versions through 2.002. The vulnerability stems from insufficient validation of output buffer sizes in key cryptographic functions including bin2hex, encrypt, aes256gcm_encrypt_afternm, and seal. These functions fail to ensure that the calculated output size does not exceed the maximum value representable by the system's size_t type (SIZE_MAX). When extremely large input lengths are provided—exceeding thresholds such as SIZE_MAX/2 for bin2hex or SIZE_MAX minus small constants for the encryption functions—an integer wraparound can occur. This wraparound results in an undersized output buffer allocation, which can cause buffer overflows or memory corruption during subsequent operations. While theoretically serious, the practical exploitation is constrained by the requirement for very large input sizes, which are uncommon in typical application scenarios. The vulnerability is categorized under CWE-190 (Integer Overflow or Wraparound). No CVSS score has been assigned yet, and no patches or known exploits are currently available. The flaw could lead to denial of service or potentially memory corruption, but does not directly enable remote code execution or privilege escalation without additional vulnerabilities.

The primary impact of this vulnerability is the potential for memory corruption due to integer overflow-induced buffer misallocation. This can lead to application crashes or denial of service in systems relying on Crypt::NaCl::Sodium for cryptographic operations. Although remote code execution is not directly indicated, memory corruption vulnerabilities can sometimes be leveraged in complex attack chains. The requirement for very large input sizes limits the scope of exploitation, reducing the likelihood of widespread impact. However, organizations processing large volumes of data or using this module in automated cryptographic pipelines might experience stability issues or service disruptions. Confidentiality and integrity of data are not directly compromised by this vulnerability alone, but availability could be affected. The absence of known exploits in the wild further reduces immediate risk but does not eliminate the need for vigilance. The vulnerability may also affect software supply chains that incorporate this Perl module, potentially impacting downstream applications.

Organizations using Crypt::NaCl::Sodium should monitor for official patches or updates from the vendor addressing this integer overflow issue. Until a patch is available, developers should implement input validation to restrict message sizes to well below the thresholds that trigger the overflow (e.g., significantly less than SIZE_MAX/2 for bin2hex and corresponding limits for encryption functions). Employing fuzz testing and static analysis tools can help identify unsafe input handling in cryptographic code. Where feasible, consider using alternative cryptographic libraries with robust input size checks. Additionally, sandboxing or isolating processes that handle cryptographic operations can limit the impact of potential memory corruption. Regularly updating Perl environments and dependencies, and auditing code that uses Crypt::NaCl::Sodium for large input handling, will reduce risk. Organizations should also prepare incident response plans for potential denial of service scenarios related to this vulnerability.