Critical severity9.1NVD Advisory· Published Feb 23, 2026· Updated Jun 17, 2026

CVE-2026-2588

Description

Crypt::NaCl::Sodium versions through 2.001 for Perl has an integer overflow flaw on 32-bit systems.

Sodium.xs casts a STRLEN (size_t) to unsigned long long when passing a length pointer to libsodium functions. On 32-bit systems size_t is typically 32-bits while an unsigned long long is at least 64-bits.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Perl Foundation/Crypt::NaCl::Sodiumllm-fuzzy
Range: <=2.001
Cpan Authors/crypt-nacl-sodiumllm-fuzzy
Range: <=2.001
TIMLEGGE/Crypt::NaCl::Sodiumv5
Range: 0
Timlegge/Crypt\
cpe:2.3:a:timlegge:crypt\:\:nacl\:\:sodium:*:*:*:*:*:perl:*:*
Range: <=2.001

Patches

Vulnerability mechanics

References

github.com/cpan-authors/crypt-nacl-sodium/commit/557388bdb4da416a56663cda0154b80cd524395c.patchnvdPatch
github.com/cpan-authors/crypt-nacl-sodium/commit/8cf7f66ba922443e131c9deae1ee00fafe4f62e4.patchnvdPatch
metacpan.org/release/TIMLEGGE/Crypt-NaCl-Sodium-2.001/source/Sodium.xsnvdProductRelease Notes

News mentions

No linked articles in our index yet.

cvss	0.591
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000