CVE-2026-2588

Name of the Vulnerable Software and Affected Versions Crypt::NaCl::Sodium versions through 2.001

Description The software contains an integer overflow flaw on 32-bit systems. Specifically, the Sodium.xs component casts a STRLEN (size t) to an unsigned long long when passing a length pointer to libsodium functions. On 32-bit systems, size t is typically 32-bits, while an unsigned long long is at least 64-bits.

Recommendations Update to a version of Crypt::NaCl::Sodium later than 2.001.