CVE-2026-30910

Crypt::Sodium::XS versions through 0.001000 for Perl has potential integer overflows. Combined aead encryption, combined signature creation, and bin2hex functions do not check that output size will be less than SIZE_MAX, which could lead to integer wraparound causing an undersized output buffer. This can cause a crash in bin2hex and encryption algorithms other than aes256gcm. For aes256gcm encryption and signatures, an undersized buffer could lead to buffer overflow. Encountering this issue is unlikely as the message length would need to be very large. For bin2hex the input size would have to be > SIZE_MAX / 2 For aegis encryption the input size would need to be > SIZE_MAX - 32U For other encryption the input size would need to be > SIZE_MAX - 16U For signatures the input size would need to be > SIZE_MAX - 64U

• CWE-190

• https://metacpan.org/release/IAMB/Crypt-Sodium-XS-0.001001/changesRelease Notes
• http://www.openwall.com/lists/oss-security/2026/03/08/2Mailing List, Third Party Advisory

Published

Mar 8, 2026

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-30903External Control of File Name or Path in the Mail feature of…9.8
• CVE-2026-30904Protection Mechanism Failure in Zoom Workplace for iOS befor…4.3
• CVE-2026-30905External Control of File Name or Path in the Zoom Workplace …7.8
• CVE-2026-30906Untrusted search path in the installer for Zoom Rooms for Wi…7.8
• CVE-2026-30909Crypt::NaCl::Sodium versions through 2.002 for Perl has pote…9.8
• CVE-2026-3091An uncontrolled search path element vulnerability in Synolog…7.3
• CVE-2026-30911Apache Airflow versions 3.1.0 through 3.1.7 missing authoriz…8.1
• CVE-2026-30912In case of SQL errors, exception/stack trace of errors was e…7.5
• CVE-2026-30913Flarum is open-source forum software. When the flarum/nickna…4.6
• CVE-2026-30914SFTPGo is an open source, event-driven file transfer solutio…8.1
• CVE-2026-30915SFTPGo is an open source, event-driven file transfer solutio…4.3
• CVE-2026-30916Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…