DDICK Crypt::URandom up to 0.54 on Perl crypt_urandom_getrandom length heap-based overflow

Summaryinfo

A vulnerability was found in DDICK Crypt::URandom up to 0.54 on Perl. It has been declared as critical. Affected by this issue is the function crypt_urandom_getrandom. Such manipulation of the argument length leads to heap-based overflow. This vulnerability is documented as CVE-2026-2474. The attack can be executed remotely. There is not any exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in DDICK Crypt::URandom up to 0.54 on Perl and classified as critical. Affected by this issue is the function crypt_urandom_getrandom. The manipulation of the argument length with an unknown input leads to a heap-based overflow vulnerability. Using CWE to declare the problem leads to CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). Impacted is confidentiality, integrity, and availability. CVE summarizes:

Crypt::URandom versions from 0.41 before 0.55 for Perl is vulnerable to a heap buffer overflow in the XS function crypt_urandom_getrandom(). The function does not validate that the length parameter is non-negative. If a negative value (e.g. -1) is supplied, the expression length + 1u causes an integer wraparound, resulting in a zero-byte allocation. The subsequent call to getrandom(data, length, GRND_NONBLOCK) passes the original negative value, which is implicitly converted to a large unsigned value (typically SIZE_MAX). This can result in writes beyond the allocated buffer, leading to heap memory corruption and application crash (denial of service). In common usage, the length argument is typically hardcoded by the caller, which reduces the likelihood of attacker-controlled exploitation. Applications that pass untrusted input to this parameter may be affected.

The advisory is available at metacpan.org. This vulnerability is handled as CVE-2026-2474 since 02/13/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. Technical details are known, but there is no available exploit.

The vulnerability scanner Nessus provides a plugin with the ID 299287 (Linux Distros Unpatched Vulnerability : CVE-2026-2474), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 0.55 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (299287) and CERT Bund (WID-SEC-2026-0688). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Affected

• cPanel cPanel/WHM

Productinfo

Vendor

• DDICK

Name

• Crypt::URandom

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9
• 0.10
• 0.11
• 0.12
• 0.13
• 0.14
• 0.15
• 0.16
• 0.17
• 0.18
• 0.19
• 0.20
• 0.21
• 0.22
• 0.23
• 0.24
• 0.25
• 0.26
• 0.27
• 0.28
• 0.29
• 0.30
• 0.31
• 0.32
• 0.33
• 0.34
• 0.35
• 0.36
• 0.37
• 0.38
• 0.39
• 0.40
• 0.41
• 0.42
• 0.43
• 0.44
• 0.45
• 0.46
• 0.47
• 0.48
• 0.49
• 0.50
• 0.51
• 0.52
• 0.53
• 0.54

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion