CVE-2026-59146

Received Received - Intake

Out-of-Bounds Read/Write in Data::SpatialHash::Shared Perl Module

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: CPANSec

Description

Data::SpatialHash::Shared versions before 0.02 for Perl allow out-of-bounds reads and writes via unvalidated bucket, link and free-list indices in sph_walk_cell and sph_alloc_slot. The attach-time validator sph_validate_header checks the header scalars and region layout against the file size, but does not validate the array contents it then trusts. sph_walk_cell reads entries[buckets[b]] and follows each entry's next link raw, and sph_alloc_slot writes through a file-stored free_head index, none bounded against the entry count (max_entries). A local peer that can write the backing file can leave the header valid while poisoning the bucket chain and free list, so a query reads through an out-of-bounds bucket and next index and an insert writes through an out-of-bounds free-list head, corrupting memory or crashing the process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-21

Generated

2026-07-22

AI Q&A

2026-07-22

EPSS Evaluated

N/A

NVD

CVE-2026-59146

EUVD

EUVD-2026-46367

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability affects the Perl module Data::SpatialHash::Shared versions before 0.02. It allows out-of-bounds reads and writes due to unvalidated indices in bucket, link, and free-list operations. The sph_validate_header function checks file size and region layout but not array contents, leading to potential memory corruption or crashes when processing corrupted files.

Detection Guidance

This vulnerability affects Perl modules using Data::SpatialHash::Shared versions before 0.02. Detection requires checking installed Perl module versions and examining code for unsafe file operations. Use commands like 'cpan -D Data::SpatialHash::Shared' to check versions and review application code for file-backed spatial hash operations.

Impact Analysis

If you use Data::SpatialHash::Shared before version 0.02, an attacker with write access to the backing file could exploit this to corrupt memory or crash your application. This could lead to data loss, denial of service, or potentially allow arbitrary code execution depending on the context.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to memory corruption in a Perl module rather than data privacy or security controls.

Mitigation Strategies

Immediately upgrade to Data::SpatialHash::Shared version 0.02 or later. If upgrading is not possible, disable or remove any applications using this module until patched. Review file permissions on any data files used by the module to ensure only trusted users can write to them.

Hi! I’m here to help you understand CVE-2026-59146. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70