CVE-2026-59142
Deferred Deferred - Pending Action

Out-of-Bounds Read in Data::HashMap::Shared for Perl

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: CPANSec

Description
Data::HashMap::Shared versions before 0.14 for Perl allow an out-of-bounds read via an unvalidated arena offset and length in shm_str_copy. The attach-time validator shm_validate_header checks the header scalars and region layout against the file size, but does not validate the array contents it then trusts. shm_str_copy does memcpy(dst, arena + off, len) with off and len read raw from the mmap'd segment and unbounded, on the each, keys, values, pop, shift, take, swap, drain and cursor paths. The get path bounds off and len separately and is not affected. A local peer that can write the backing file can leave the header valid while poisoning a record's offset and length, so iterating or draining the map copies a file-controlled offset and length out of the arena, reading adjacent memory or crashing the process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-21
Last Modified
2026-07-21
Generated
2026-07-22
AI Q&A
2026-07-21
EPSS Evaluated
N/A
NVD
CVE-2026-59142
EUVD
EUVD-2026-46355

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an out-of-bounds read in Data::HashMap::Shared versions before 0.14 for Perl. It occurs because the function shm_str_copy does not validate the offset and length parameters read from a memory-mapped file. A local attacker who can write to the backing file can manipulate these values to read adjacent memory or crash the process.

Detection Guidance

This vulnerability involves an out-of-bounds read in Data::HashMap::Shared for Perl. Detection requires checking for vulnerable versions of the module. Use Perl's module list command: perl -MData::HashMap::Shared -e 'print $Data::HashMap::Shared::VERSION' to check the installed version. If the version is below 0.14, the system is vulnerable.

Impact Analysis

If exploited, this vulnerability could allow a local attacker to read sensitive memory outside the intended data structure or cause a denial-of-service by crashing the process. This could lead to information disclosure or application instability.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a local memory corruption issue in a Perl module. It may indirectly impact compliance if exploited to access sensitive data, but no evidence of such impact is provided in the CVE details.

Mitigation Strategies

Immediately update Data::HashMap::Shared to version 0.14 or later using your package manager or CPAN: cpan Data::HashMap::Shared. If updating is not possible, restrict write access to the backing file to prevent local attackers from poisoning the offset and length values.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-59142. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart