CVE-2026-2597

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2597", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "state": "PUBLISHED", "assignerShortName": "CPANSec", "dateReserved": "2026-02-16T20:27:02.194Z", "datePublished": "2026-02-26T23:29:16.488Z", "dateUpdated": "2026-02-27T18:50:46.353Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "Crypt-SysRandom-XS", "product": "Crypt::SysRandom::XS", "programFiles": ["lib/Crypt/SysRandom/XS.xs"], "programRoutines": [{"name": "random_bytes()"}], "repo": "https://github.com/Leont/crypt-sysrandom-xs", "vendor": "LEONT", "versions": [{"lessThan": "0.010", "status": "affected", "version": "0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "Crypt::SysRandom::XS versions before 0.010 for Perl is vulnerable to a heap buffer overflow in the XS function random_bytes().\n\nThe function does not validate that the length parameter is non-negative. If a negative value (e.g. -1) is supplied, the expression length + 1u causes an integer wraparound, resulting in a zero-byte allocation. The subsequent call to chosen random function (e.g. getrandom) passes the original negative value, which is implicitly converted to a large unsigned value (typically SIZE_MAX). This can result in writes beyond the allocated buffer, leading to heap memory corruption and application crash (denial of service).\n\nIn common usage, the length argument is typically hardcoded by the caller, which reduces the likelihood of attacker-controlled exploitation. Applications that pass untrusted input to this parameter may be affected."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-122", "description": "CWE-122 Heap-based Buffer Overflow", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-1284", "description": "CWE-1284 Improper Validation of Specified Quantity in Input", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-02-26T23:29:16.488Z"}, "references": [{"tags": ["release-notes"], "url": "https://metacpan.org/dist/Crypt-SysRandom-XS/changes"}, {"tags": ["related"], "url": "https://metacpan.org/release/LEONT/Crypt-SysRandom-XS-0.011/source/lib/Crypt/SysRandom/XS.xs#L51-52"}], "solutions": [{"lang": "en", "value": "Update to version 0.010 or later"}], "source": {"discovery": "UNKNOWN"}, "title": "Crypt::SysRandom::XS versions before 0.010 for Perl is vulnerable to a heap buffer overflow in the XS function random_bytes()", "x_generator": {"engine": "cpansec-cna-tool 0.1"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-02-27T18:50:03.345736Z", "id": "CVE-2026-2597", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-27T18:50:46.353Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-2597", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-27T18:50:03.345736Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-27T18:50:24.429Z"}}], "cna": {"title": "Crypt::SysRandom::XS versions before 0.010 for Perl is vulnerable to a heap buffer overflow in the XS function random_bytes()", "source": {"discovery": "UNKNOWN"}, "affected": [{"repo": "https://github.com/Leont/crypt-sysrandom-xs", "vendor": "LEONT", "product": "Crypt::SysRandom::XS", "versions": [{"status": "affected", "version": "0", "lessThan": "0.010", "versionType": "custom"}], "packageName": "Crypt-SysRandom-XS", "programFiles": ["lib/Crypt/SysRandom/XS.xs"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "random_bytes()"}]}], "solutions": [{"lang": "en", "value": "Update to version 0.010 or later"}], "references": [{"url": "https://metacpan.org/dist/Crypt-SysRandom-XS/changes", "tags": ["release-notes"]}, {"url": "https://metacpan.org/release/LEONT/Crypt-SysRandom-XS-0.011/source/lib/Crypt/SysRandom/XS.xs#L51-52", "tags": ["related"]}], "x_generator": {"engine": "cpansec-cna-tool 0.1"}, "descriptions": [{"lang": "en", "value": "Crypt::SysRandom::XS versions before 0.010 for Perl is vulnerable to a heap buffer overflow in the XS function random_bytes().\n\nThe function does not validate that the length parameter is non-negative. If a negative value (e.g. -1) is supplied, the expression length + 1u causes an integer wraparound, resulting in a zero-byte allocation. The subsequent call to chosen random function (e.g. getrandom) passes the original negative value, which is implicitly converted to a large unsigned value (typically SIZE_MAX). This can result in writes beyond the allocated buffer, leading to heap memory corruption and application crash (denial of service).\n\nIn common usage, the length argument is typically hardcoded by the caller, which reduces the likelihood of attacker-controlled exploitation. Applications that pass untrusted input to this parameter may be affected."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-122", "description": "CWE-122 Heap-based Buffer Overflow"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1284", "description": "CWE-1284 Improper Validation of Specified Quantity in Input"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-02-26T23:29:16.488Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2597", "state": "PUBLISHED", "dateUpdated": "2026-02-27T18:50:46.353Z", "dateReserved": "2026-02-16T20:27:02.194Z", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "datePublished": "2026-02-26T23:29:16.488Z", "assignerShortName": "CPANSec"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "Crypt-SysRandom-XS", "product": "Crypt::SysRandom::XS", "programFiles": ["lib/Crypt/SysRandom/XS.xs"], "programRoutines": [{"name": "random_bytes()"}], "repo": "https://github.com/Leont/crypt-sysrandom-xs", "vendor": "LEONT", "versions": [{"lessThan": "0.010", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:leont:crypt\\:\\:sysrandom\\:\\:xs:*:*:*:*:*:perl:*:*", "matchCriteriaId": "AD58A198-257B-424C-8927-5C5A5D11B535", "versionEndExcluding": "0.010", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Crypt::SysRandom::XS versions before 0.010 for Perl is vulnerable to a heap buffer overflow in the XS function random_bytes().\n\nThe function does not validate that the length parameter is non-negative. If a negative value (e.g. -1) is supplied, the expression length + 1u causes an integer wraparound, resulting in a zero-byte allocation. The subsequent call to chosen random function (e.g. getrandom) passes the original negative value, which is implicitly converted to a large unsigned value (typically SIZE_MAX). This can result in writes beyond the allocated buffer, leading to heap memory corruption and application crash (denial of service).\n\nIn common usage, the length argument is typically hardcoded by the caller, which reduces the likelihood of attacker-controlled exploitation. Applications that pass untrusted input to this parameter may be affected."}, {"lang": "es", "value": "Las versiones de Crypt::SysRandom::XS anteriores a la 0.010 para Perl son vulnerables a un desbordamiento de b\u00fafer de mont\u00f3n en la funci\u00f3n XS random_bytes().\n\nLa funci\u00f3n no valida que el par\u00e1metro de longitud no sea negativo. Si se proporciona un valor negativo (p. ej., -1), la expresi\u00f3n length + 1u causa un desbordamiento de enteros, lo que resulta en una asignaci\u00f3n de cero bytes. La llamada subsiguiente a la funci\u00f3n aleatoria elegida (p. ej., getrandom) pasa el valor negativo original, que se convierte impl\u00edcitamente a un valor sin signo grande (t\u00edpicamente SIZE_MAX). Esto puede resultar en escrituras m\u00e1s all\u00e1 del b\u00fafer asignado, lo que lleva a corrupci\u00f3n de memoria de mont\u00f3n y a un fallo de la aplicaci\u00f3n (denegaci\u00f3n de servicio).\n\nEn el uso com\u00fan, el argumento de longitud suele estar codificado de forma r\u00edgida por el llamador, lo que reduce la probabilidad de explotaci\u00f3n controlada por el atacante. Las aplicaciones que pasan entrada no confiable a este par\u00e1metro pueden verse afectadas."}], "id": "CVE-2026-2597", "lastModified": "2026-06-17T10:31:22.530", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2597", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-27T18:50:03.345736Z", "version": "2.0.3"}}]}, "published": "2026-02-27T00:16:58.587", "references": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "tags": ["Release Notes"], "url": "https://metacpan.org/dist/Crypt-SysRandom-XS/changes"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "tags": ["Issue Tracking"], "url": "https://metacpan.org/release/LEONT/Crypt-SysRandom-XS-0.011/source/lib/Crypt/SysRandom/XS.xs#L51-52"}], "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-122"}, {"lang": "en", "value": "CWE-1284"}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,0.010)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Crypt::SysRandom::XS", "source": "cna", "vendor": "LEONT"}, "product": "crypt::sysrandom::xs", "vendor": "leont"}], "analysis": {"en": {"generated_at": "2026-04-18T10:20:31.166431+00:00", "value": {"mitigation_remediation": ["Apply the vendor\u2011supplied fix by upgrading Crypt::SysRandom::XS to version 0.010 or newer", "Ensure all callers validate the length parameter to be non\u2011negative before invoking random_bytes()", "If an upgrade is not immediately possible, disable or replace the module with a safer random\u2011byte routine and monitor for crash symptoms"], "summary": {"action": "Apply patch", "impact": "Denial of Service via Heap Buffer Overflow"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the Crypt::SysRandom::XS module distributed by LEONT for Perl. All releases older than version 0.010 are susceptible. Most deployments use hard\u2011coded length arguments, which reduces the chance of exploitation, but any Perl application that forwards untrusted input to the random_bytes() function is potentially impacted.", "description_and_impact": "Crypt::SysRandom::XS versions before 0.010 do not check that the requested byte length is non\u2011negative. Supplying a negative value causes an integer wraparound, allocating a zero\u2011byte buffer while a large unsigned value is later used for the actual data request. This results in memory writes beyond the allocated heap space, corrupting adjacent data and typically crashing the application. The impact is a denial of service.", "risk_and_exploitability": "The CVSS score is 7.5, qualifying as High severity. The EPSS score is reported as less than 1%, indicating a very low probability of observation, and the flaw is not yet listed in the CISA KEV catalog. The likely attack vector is application\u2011level, requiring that the user process or a component passing untrusted data to random_bytes() can supply a negative value. Although exploitation is not trivial, a successful trial would lead to a crash."}}}}, "created": "2026-02-27T09:03:35.664625+00:00", "updated": "2026-04-18T10:30:35.756585+00:00", "vendors": ["leont", "leont$PRODUCT$crypt::sysrandom::xs"]}