/ 
Crypt-Sodium-XS-0.001000
Security Advisories (1)
CVE-2026-30910 (2026-03-08)

Crypt::Sodium::XS versions through 0.001000 for Perl has potential integer overflows. Combined aead encryption, combined signature creation, and bin2hex functions do not check that output size will be less than SIZE_MAX, which could lead to integer wraparound causing an undersized output buffer. This can cause a crash in bin2hex and encryption algorithms other than aes256gcm. For aes256gcm encryption and signatures, an undersized buffer could lead to buffer overflow. Encountering this issue is unlikely as the message length would need to be very large. For bin2hex the input size would have to be > SIZE_MAX / 2 For aegis encryption the input size would need to be > SIZE_MAX - 32U For other encryption the input size would need to be > SIZE_MAX - 16U For signatures the input size would need to be > SIZE_MAX - 64U

Changes for version 0.001000

  • large re-factor (mostly just deduplication) of perl module code. one user-facing change: packages in the Crypt::Sodium::XS::OO:: namespace can no longer be imported directly. they really shouldn't have been previously, but it will no longer work. if any code was doing so, remove the "::OO" from the package name where it is imported (e.g., "use Crypt::Sodium::XS::OO::box" becomes "use Crypt::Sodium::XS::box") and no further changes are necessary.
  • bump libsodium to version 1.0.21-stable as of Jan 21
  • implement new ipcrypt feature from 1.0.21
  • add related sodium_bin2ip and sodium_ip2bin from 1.0.21
  • minor bugfixes and improvements

Documentation

CONTRIBUTING.md
SECURITY.md
csxs-ppcrypt
simple passphrase-based encryption and decryption
pminisign
perl implementation of minisign

Modules

Crypt::Sodium::XS
perl XS bindings for libsodium
Crypt::Sodium::XS::Base64
libsodium base64 functions and constants
Crypt::Sodium::XS::Core
libsodium low-level functions
Crypt::Sodium::XS::MemVault
Protected memory objects
Crypt::Sodium::XS::ProtMem
Memory protection functions and constants
Crypt::Sodium::XS::Util
libsodium utilities
Crypt::Sodium::XS::aead
Authenticated encryption with additional data
Crypt::Sodium::XS::auth
Secret key message authentication
Crypt::Sodium::XS::box
Asymmetric (public/secret key) authenticated encryption
Crypt::Sodium::XS::curve25519
Low-level functions over Curve25519
Crypt::Sodium::XS::generichash
Cryptographic hashing
Crypt::Sodium::XS::hash
SHA2 cryptographic hashing
Crypt::Sodium::XS::hkdf
HMAC-based Extract-and-Expand Key Derivation Function
Crypt::Sodium::XS::ipcrypt
IP address encryption
Crypt::Sodium::XS::kdf
Secret subkey derivation from a main secret key
Crypt::Sodium::XS::kx
Shared key derivation from client/server asymmetric key pairs
Crypt::Sodium::XS::onetimeauth
Single-use secret key message authentication
Crypt::Sodium::XS::pwhash
Password hashing and verification
Crypt::Sodium::XS::scalarmult
Point-scalar multiplication on the Curve25519 curve.
Crypt::Sodium::XS::secretbox
Secret key authenticated encryption
Crypt::Sodium::XS::secretstream
Secret key authenticated encryption for multiple in-order messages
Crypt::Sodium::XS::shorthash
Short-input hashing
Crypt::Sodium::XS::sign
Asymmetric (public/secret key) signatures and verification
Crypt::Sodium::XS::stream
Stream ciphers

Provides

Crypt::Sodium::XS::Base
in lib/Crypt/Sodium/XS/Base.pm
Crypt::Sodium::XS::OO::Base
in lib/Crypt/Sodium/XS/OO/Base.pm
Crypt::Sodium::XS::OO::aead
in lib/Crypt/Sodium/XS/aead.pm
Crypt::Sodium::XS::OO::auth
in lib/Crypt/Sodium/XS/auth.pm
Crypt::Sodium::XS::OO::box
in lib/Crypt/Sodium/XS/box.pm
Crypt::Sodium::XS::OO::curve25519
in lib/Crypt/Sodium/XS/curve25519.pm
Crypt::Sodium::XS::OO::generichash
in lib/Crypt/Sodium/XS/generichash.pm
Crypt::Sodium::XS::OO::hash
in lib/Crypt/Sodium/XS/hash.pm
Crypt::Sodium::XS::OO::hkdf
in lib/Crypt/Sodium/XS/hkdf.pm
Crypt::Sodium::XS::OO::ipcrypt
in lib/Crypt/Sodium/XS/ipcrypt.pm
Crypt::Sodium::XS::OO::kdf
in lib/Crypt/Sodium/XS/kdf.pm
Crypt::Sodium::XS::OO::kx
in lib/Crypt/Sodium/XS/kx.pm
Crypt::Sodium::XS::OO::onetimeauth
in lib/Crypt/Sodium/XS/onetimeauth.pm
Crypt::Sodium::XS::OO::pwhash
in lib/Crypt/Sodium/XS/pwhash.pm
Crypt::Sodium::XS::OO::scalarmult
in lib/Crypt/Sodium/XS/scalarmult.pm
Crypt::Sodium::XS::OO::secretbox
in lib/Crypt/Sodium/XS/secretbox.pm
Crypt::Sodium::XS::OO::secretstream
in lib/Crypt/Sodium/XS/secretstream.pm
Crypt::Sodium::XS::OO::shorthash
in lib/Crypt/Sodium/XS/shorthash.pm
Crypt::Sodium::XS::OO::sign
in lib/Crypt/Sodium/XS/sign.pm
Crypt::Sodium::XS::OO::stream
in lib/Crypt/Sodium/XS/stream.pm

Other files