CVE-2026-30910

Crypt::Sodium::XS versions through 0.001000 for Perl has potential integer overflows.<br /> <br /> Combined aead encryption, combined signature creation, and bin2hex functions do not check that output size will be less than SIZE_MAX, which could lead to integer wraparound causing an undersized output buffer. This can cause a crash in bin2hex and encryption algorithms other than aes256gcm. For aes256gcm encryption and signatures, an undersized buffer could lead to buffer overflow.<br /> <br /> Encountering this issue is unlikely as the message length would need to be very large.<br /> <br /> For bin2hex the input size would have to be &gt; SIZE_MAX / 2 For aegis encryption the input size would need to be &gt; SIZE_MAX - 32U For other encryption the input size would need to be &gt; SIZE_MAX - 16U For signatures the input size would need to be &gt; SIZE_MAX - 64U