CVE-2026-2474

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2474", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "state": "PUBLISHED", "assignerShortName": "CPANSec", "dateReserved": "2026-02-13T15:45:19.206Z", "datePublished": "2026-02-16T20:54:51.357Z", "dateUpdated": "2026-02-17T14:48:49.595Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "Crypt-URandom", "product": "Crypt::URandom", "programFiles": ["URandom.xs"], "programRoutines": [{"name": "crypt_urandom_getrandom()"}], "repo": "https://github.com/david-dick/crypt-urandom", "vendor": "DDICK", "versions": [{"lessThan": "0.55", "status": "affected", "version": "0.41", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "Crypt::URandom versions from 0.41 before 0.55 for Perl is vulnerable to a heap buffer overflow in the XS function crypt_urandom_getrandom().\n\nThe function does not validate that the length parameter is non-negative. If a negative value (e.g. -1) is supplied, the expression length + 1u causes an integer wraparound, resulting in a zero-byte allocation. The subsequent call to getrandom(data, length, GRND_NONBLOCK) passes the original negative value, which is implicitly converted to a large unsigned value (typically SIZE_MAX). This can result in writes beyond the allocated buffer, leading to heap memory corruption and application crash (denial of service).\n\nIn common usage, the length argument is typically hardcoded by the caller, which reduces the likelihood of attacker-controlled exploitation. Applications that pass untrusted input to this parameter may be affected."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-122", "description": "CWE-122 Heap-based Buffer Overflow", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-1284", "description": "CWE-1284 Improper Validation of Specified Quantity in Input", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-02-16T20:54:51.357Z"}, "references": [{"tags": ["release-notes"], "url": "https://metacpan.org/release/DDICK/Crypt-URandom-0.55/source/Changes"}, {"tags": ["related"], "url": "https://metacpan.org/release/DDICK/Crypt-URandom-0.54/source/URandom.xs#L35-79"}], "solutions": [{"lang": "en", "value": "Update to version 0.55 or later"}], "source": {"discovery": "UNKNOWN"}, "title": "Crypt::URandom versions from 0.41 before 0.55 for Perl is vulnerable to a heap buffer overflow in the XS function crypt_urandom_getrandom()", "x_generator": {"engine": "cpansec-cna-tool 0.1"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-02-17T14:47:36.338726Z", "id": "CVE-2026-2474", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-17T14:48:49.595Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-2474", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-17T14:47:36.338726Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-17T14:48:44.873Z"}}], "cna": {"title": "Crypt::URandom versions from 0.41 before 0.55 for Perl is vulnerable to a heap buffer overflow in the XS function crypt_urandom_getrandom()", "source": {"discovery": "UNKNOWN"}, "affected": [{"repo": "https://github.com/david-dick/crypt-urandom", "vendor": "DDICK", "product": "Crypt::URandom", "versions": [{"status": "affected", "version": "0.41", "lessThan": "0.55", "versionType": "custom"}], "packageName": "Crypt-URandom", "programFiles": ["URandom.xs"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "crypt_urandom_getrandom()"}]}], "solutions": [{"lang": "en", "value": "Update to version 0.55 or later"}], "references": [{"url": "https://metacpan.org/release/DDICK/Crypt-URandom-0.55/source/Changes", "tags": ["release-notes"]}, {"url": "https://metacpan.org/release/DDICK/Crypt-URandom-0.54/source/URandom.xs#L35-79", "tags": ["related"]}], "x_generator": {"engine": "cpansec-cna-tool 0.1"}, "descriptions": [{"lang": "en", "value": "Crypt::URandom versions from 0.41 before 0.55 for Perl is vulnerable to a heap buffer overflow in the XS function crypt_urandom_getrandom().\n\nThe function does not validate that the length parameter is non-negative. If a negative value (e.g. -1) is supplied, the expression length + 1u causes an integer wraparound, resulting in a zero-byte allocation. The subsequent call to getrandom(data, length, GRND_NONBLOCK) passes the original negative value, which is implicitly converted to a large unsigned value (typically SIZE_MAX). This can result in writes beyond the allocated buffer, leading to heap memory corruption and application crash (denial of service).\n\nIn common usage, the length argument is typically hardcoded by the caller, which reduces the likelihood of attacker-controlled exploitation. Applications that pass untrusted input to this parameter may be affected."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-122", "description": "CWE-122 Heap-based Buffer Overflow"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1284", "description": "CWE-1284 Improper Validation of Specified Quantity in Input"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-02-16T20:54:51.357Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2474", "state": "PUBLISHED", "dateUpdated": "2026-02-17T14:48:49.595Z", "dateReserved": "2026-02-13T15:45:19.206Z", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "datePublished": "2026-02-16T20:54:51.357Z", "assignerShortName": "CPANSec"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "Crypt-URandom", "product": "Crypt::URandom", "programFiles": ["URandom.xs"], "programRoutines": [{"name": "crypt_urandom_getrandom()"}], "repo": "https://github.com/david-dick/crypt-urandom", "vendor": "DDICK", "versions": [{"lessThan": "0.55", "status": "affected", "version": "0.41", "versionType": "custom"}]}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ddick:crypt\\:\\:urandom:*:*:*:*:*:perl:*:*", "matchCriteriaId": "4FFA138E-FEF2-445E-A513-9C69AEFC03CF", "versionEndExcluding": "0.55", "versionStartIncluding": "0.41", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Crypt::URandom versions from 0.41 before 0.55 for Perl is vulnerable to a heap buffer overflow in the XS function crypt_urandom_getrandom().\n\nThe function does not validate that the length parameter is non-negative. If a negative value (e.g. -1) is supplied, the expression length + 1u causes an integer wraparound, resulting in a zero-byte allocation. The subsequent call to getrandom(data, length, GRND_NONBLOCK) passes the original negative value, which is implicitly converted to a large unsigned value (typically SIZE_MAX). This can result in writes beyond the allocated buffer, leading to heap memory corruption and application crash (denial of service).\n\nIn common usage, the length argument is typically hardcoded by the caller, which reduces the likelihood of attacker-controlled exploitation. Applications that pass untrusted input to this parameter may be affected."}, {"lang": "es", "value": "Las versiones de Crypt::URandom de 0.41 anteriores a 0.55 para Perl son vulnerables a un desbordamiento de b\u00fafer de mont\u00f3n en la funci\u00f3n XS crypt_urandom_getrandom().\n\nLa funci\u00f3n no valida que el par\u00e1metro de longitud no sea negativo. Si se proporciona un valor negativo (p. ej., -1), la expresi\u00f3n length + 1u causa un desbordamiento de enteros, lo que resulta en una asignaci\u00f3n de cero bytes. La llamada subsiguiente a getrandom(data, length, GRND_NONBLOCK) pasa el valor negativo original, que se convierte impl\u00edcitamente a un valor sin signo grande (t\u00edpicamente SIZE_MAX). Esto puede resultar en escrituras m\u00e1s all\u00e1 del b\u00fafer asignado, lo que lleva a corrupci\u00f3n de memoria en el mont\u00f3n y a un fallo de la aplicaci\u00f3n (denegaci\u00f3n de servicio).\n\nEn el uso com\u00fan, el argumento de longitud suele estar codificado de forma r\u00edgida por el llamador, lo que reduce la probabilidad de explotaci\u00f3n controlada por el atacante. Las aplicaciones que pasan entrada no confiable a este par\u00e1metro pueden verse afectadas."}], "id": "CVE-2026-2474", "lastModified": "2026-06-17T10:31:08.167", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2474", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-17T14:47:36.338726Z", "version": "2.0.3"}}]}, "published": "2026-02-16T21:22:18.107", "references": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "tags": ["Issue Tracking"], "url": "https://metacpan.org/release/DDICK/Crypt-URandom-0.54/source/URandom.xs#L35-79"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "tags": ["Product", "Release Notes"], "url": "https://metacpan.org/release/DDICK/Crypt-URandom-0.55/source/Changes"}], "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-122"}, {"lang": "en", "value": "CWE-1284"}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0.41,0.55)"}}], "product": "crypt::urandom", "vendor": "ddick"}], "analysis": {"en": {"generated_at": "2026-04-18T17:58:19.547018+00:00", "value": {"mitigation_remediation": ["Update the Crypt::URandom module to version 0.55 or later.", "Validate the length parameter in application code before calling crypt_urandom_getrandom(), ensuring it is non\u2011negative.", "Restrict the length argument to trusted or sanitized sources to prevent accidental negative values."], "summary": {"action": "Patch", "impact": "Heap Buffer Overflow \u2013 potential memory corruption and denial of service"}, "threat_synthesis": {"affected_systems": "All installations of the DDICK Crypt::URandom module from version 0.41 up to and including 0.54 are affected. The fix is included in version 0.55 and later, which validates the length argument. The vulnerability applies to all platforms that use these versions, regardless of operating system, because it resides in native XS code shared across Perl interpreters. No specific operating system or architecture is excluded by the CVE data.", "description_and_impact": "The Perl module Crypt::URandom contains a heap buffer overflow in the XS function crypt_urandom_getrandom() when the length argument is negative. Because the function fails to validate that the length is non\u2011negative, a negative value such as \u20131 causes an integer wraparound; the calculation length + 1u results in zero bytes allocated, while the subsequent call to getrandom() passes the original negative value as an unsigned quantity, typically SIZE_MAX. This mismatch allows the module to write beyond the allocated buffer, corrupting heap memory and causing the application to crash, which manifests as a denial of service. The vulnerability does not provide a direct path to remote code execution or information disclosure by itself. Based on the description, it is inferred that the attacker would need to provide a negative length argument, which in practice would require a point of input that is not properly validated or is controlled by an attacker.", "risk_and_exploitability": "The CVSS base score of 7.5 indicates high severity, while the EPSS score below 1% suggests a very low probability of exploitation in the wild. The vulnerability is not listed in CISA's KEV catalog. The most likely attack vector, inferred from the lack of explicit user interaction in the CVE data, is through malicious or improperly sanitized input supplied to the length parameter. In typical usage the length is hardcoded, which limits exploitation opportunities, but applications that accept untrusted input for this parameter remain at risk of triggering the heap overflow and causing a denial of service."}}}}, "created": "2026-02-17T08:49:00.209642+00:00", "updated": "2026-04-18T18:00:06.468715+00:00", "vendors": ["ddick", "ddick$PRODUCT$crypt::urandom"]}