CVE-2026-30910 affects Crypt::Sodium::XS versions through 0.001000 for Perl, involving potential integer overflows in combined AEAD encryption, signature creation, and bin2hex functions. These functions do not adequately check output buffer sizes, which could lead to integer wraparound and undersized buffers, potentially causing crashes or buffer overflows. While the vulnerability has a FAUCET Risk Score of 20/100 and an EPSS score of 0.000110000, its exploitation is considered unlikely due to the extremely large message lengths required to trigger the issue. There is no known active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or KEV listing, though it has received some community discussion and media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 0, <= 0.001000CPE match | cpe:2.3:a:iamb:crypt\:\:sodium\:\:xs:*:*:*:*:*:perl:*:* | ||
<= 0.001001CPE matchmatch criteria | cpe:2.3:a:iamb:crypt\:\:sodium\:\:xs:*:*:*:*:*:perl:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.