CVE-2026-2597

CVE-2026-2597 affects Crypt::SysRandom::XS for Perl prior to 0.010. The XS function random_bytes() fails to validate that the length parameter is non-negative; a negative length (e.g., -1) triggers an integer wraparound (length + 1u), causing a zero-byte allocation. The subsequent random function...