Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.1
CVE-2026-59142: Perl Data::HashMap::Shared versions before 0.14: Out-of-bounds read via malicious file
CVE-2026-59142 · published 3 months ago
Summary
If an attacker has access to the file used by Data::HashMap::Shared, they can create a file that allows them to read data outside of the intended boundaries. This could potentially allow them to access sensitive information or cause the program to crash. To protect against this, update to version 0.14 or later of Data::HashMap::Shared.
What to do
- Update egor data::hashmap::shared to version 0.14 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| egor | data::hashmap::shared | < 0.14 |
Original advisory text
Data::HashMap::Shared versions before 0.14 for Perl allow an out-of-bounds read via an unvalidated arena offset and length in shm_str_copy.
The attach-time validator shm_validate_header checks the...
Data::HashMap::Shared versions before 0.14 for Perl allow an out-of-bounds read via an unvalidated arena offset and length in shm_str_copy.
The attach-time validator shm_validate_header checks the header scalars and region layout against the file size, but does not validate the array contents it then trusts. shm_str_copy does memcpy(dst, arena + off, len) with off and len read raw from the mmap'd segment and unbounded, on the each, keys, values, pop, shift, take, swap, drain and cursor paths. The get path bounds off and len separately and is not affected.
A local peer that can write the backing file can leave the header valid while poisoning a record's offset and length, so iterating or draining the map copies a file-controlled offset and length out of the arena, reading adjacent memory or crashing the process.
The attach-time validator shm_validate_header checks the header scalars and region layout against the file size, but does not validate the array contents it then trusts. shm_str_copy does memcpy(dst, arena + off, len) with off and len read raw from the mmap'd segment and unbounded, on the each, keys, values, pop, shift, take, swap, drain and cursor paths. The get path bounds off and len separately and is not affected.
A local peer that can write the backing file can leave the header valid while poisoning a record's offset and length, so iterating or draining the map copies a file-controlled offset and length out of the arena, reading adjacent memory or crashing the process.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Severity
9.1
Critical
Type
CWE-125Out-of-bounds Read
Timeline
Published21 Jul 2026
Updated4 Nov 2026
First seen21 Jul 2026
Track software like this
Free during beta