Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-59144: Perl Data::RingBuffer::Shared versions before 0.04 allow data corruption
CVE-2026-59144 · published 3 months ago
Summary
Versions of Perl's Data::RingBuffer::Shared before 0.04 can be exploited by a malicious peer to corrupt data in memory. This is a concern for systems where multiple users can share files. To fix this, update to version 0.04 or later.
What to do
- Update egor data::ringbuffer::shared to version 0.04 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| egor | data::ringbuffer::shared | < 0.04 |
Original advisory text
Data::RingBuffer::Shared versions before 0.04 for Perl allow a stack buffer overflow via an unvalidated elem_size in ring_read_seq
Data::RingBuffer::Shared versions before 0.04 for Perl allow a stack buffer overflow via an unvalidated elem_size in ring_read_seq.
The attach-time validator ring_validate_header checks the capacity-overflow and total_size consistency of the header but never caps elem_size against the destination size. ring_read_seq does memcpy(out, ring_slot(h, seq), elem_size) with elem_size read raw from the mmap'd segment, copying into a fixed 8-byte destination scalar. An elem_size larger than 8 bytes writes past the destination.
A local peer that can write the backing file can leave the header valid while setting a large elem_size, so the next read copies a file-controlled length into the fixed 8-byte stack buffer, corrupting adjacent stack frames.
The attach-time validator ring_validate_header checks the capacity-overflow and total_size consistency of the header but never caps elem_size against the destination size. ring_read_seq does memcpy(out, ring_slot(h, seq), elem_size) with elem_size read raw from the mmap'd segment, copying into a fixed 8-byte destination scalar. An elem_size larger than 8 bytes writes past the destination.
A local peer that can write the backing file can leave the header valid while setting a large elem_size, so the next read copies a file-controlled length into the fixed 8-byte stack buffer, corrupting adjacent stack frames.
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Severity
9.8
Critical
Type
CWE-121Stack-based Buffer Overflow
Timeline
Published21 Jul 2026
Updated4 Nov 2026
First seen21 Jul 2026
Track software like this
Free during beta