« Volver al listado

CVE-2026-2597

Estado: AnalizadaAlta (7.5)—

Crypt::SysRandom::XS versions before 0.010 for Perl is vulnerable to a heap buffer overflow in the XS function random_bytes().

The function does not validate that the length parameter is non-negative. If a negative value (e.g. -1) is supplied, the expression length + 1u causes an integer wraparound, resulting in a zero-byte allocation. The subsequent call to chosen random function (e.g. getrandom) passes the original negative value, which is implicitly converted to a large unsigned value (typically SIZE_MAX). This can result in writes beyond the allocated buffer, leading to heap memory corruption and application crash (denial of service).

Leer descripción completaMostrar menos

In common usage, the length argument is typically hardcoded by the caller, which reduces the likelihood of attacker-controlled exploitation. Applications that pass untrusted input to this parameter may be affected.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vector CVSS indica AV:N/PR:N (red sin privilegios). Heap buffer overflow explotable remotamente que causa crash de la aplicación (DoS).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Filter Network TrafficVulnerability ScanningPrivileged Account ManagementNetwork SegmentationLimit Access to Resource Over NetworkApplication Isolation and Sandboxing

Tecnologías afectadas (1)

Leont — Crypt\

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-2597",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-2597",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-02-27T18:50:03.345736Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "affectedData": [
        {
          "repo": "https://github.com/Leont/crypt-sysrandom-xs",
          "vendor": "LEONT",
          "product": "Crypt::SysRandom::XS",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "0.010",
              "versionType": "custom"
            }
          ],
          "packageName": "Crypt-SysRandom-XS",
          "programFiles": [
            "lib/Crypt/SysRandom/XS.xs"
          ],
          "collectionURL": "https://cpan.org/modules",
          "defaultStatus": "unaffected",
          "programRoutines": [
            {
              "name": "random_bytes()"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-02-27T00:16:58.587",
  "references": [
    {
      "url": "https://metacpan.org/dist/Crypt-SysRandom-XS/changes",
      "tags": [
        "Release Notes"
      ],
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    },
    {
      "url": "https://metacpan.org/release/LEONT/Crypt-SysRandom-XS-0.011/source/lib/Crypt/SysRandom/XS.xs#L51-52",
      "tags": [
        "Issue Tracking"
      ],
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "description": [
        {
          "lang": "en",
          "value": "CWE-122"
        },
        {
          "lang": "en",
          "value": "CWE-1284"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Crypt::SysRandom::XS versions before 0.010 for Perl is vulnerable to a heap buffer overflow in the XS function random_bytes().\n\nThe function does not validate that the length parameter is non-negative. If a negative value (e.g. -1) is supplied, the expression length + 1u causes an integer wraparound, resulting in a zero-byte allocation. The subsequent call to chosen random function (e.g. getrandom) passes the original negative value, which is implicitly converted to a large unsigned value (typically SIZE_MAX). This can result in writes beyond the allocated buffer, leading to heap memory corruption and application crash (denial of service).\n\nIn common usage, the length argument is typically hardcoded by the caller, which reduces the likelihood of attacker-controlled exploitation. Applications that pass untrusted input to this parameter may be affected."
    },
    {
      "lang": "es",
      "value": "Las versiones de Crypt::SysRandom::XS anteriores a la 0.010 para Perl son vulnerables a un desbordamiento de búfer de montón en la función XS random_bytes().\n\nLa función no valida que el parámetro de longitud no sea negativo. Si se proporciona un valor negativo (p. ej., -1), la expresión length + 1u causa un desbordamiento de enteros, lo que resulta en una asignación de cero bytes. La llamada subsiguiente a la función aleatoria elegida (p. ej., getrandom) pasa el valor negativo original, que se convierte implícitamente a un valor sin signo grande (típicamente SIZE_MAX). Esto puede resultar en escrituras más allá del búfer asignado, lo que lleva a corrupción de memoria de montón y a un fallo de la aplicación (denegación de servicio).\n\nEn el uso común, el argumento de longitud suele estar codificado de forma rígida por el llamador, lo que reduce la probabilidad de explotación controlada por el atacante. Las aplicaciones que pasan entrada no confiable a este parámetro pueden verse afectadas."
    }
  ],
  "lastModified": "2026-06-17T10:31:22.530",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:leont:crypt\\:\\:sysrandom\\:\\:xs:*:*:*:*:*:perl:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AD58A198-257B-424C-8927-5C5A5D11B535",
              "versionEndExcluding": "0.010"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
}