Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
CVE-2026-59146: Data::SpatialHash::Shared (Perl) allows data corruption or crashes via invalid indices
CVE-2026-59146 · published 3 months ago
Summary
A flaw in the Data::SpatialHash::Shared Perl module for Perl versions before 0.02 can cause data corruption or crashes when a malicious user writes to the affected file. This can happen when the module reads or writes data without proper validation, allowing an attacker to manipulate the data and cause issues. To protect against this, update to version 0.02 or later.
What to do
- Update egor data::spatialhash::shared to version 0.02 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| egor | data::spatialhash::shared | < 0.02 |
Original advisory text
Data::SpatialHash::Shared versions before 0.02 for Perl allow out-of-bounds reads and writes via unvalidated bucket, link and free-list indices in sph_walk_cell and sph_alloc_slot
Data::SpatialHash::Shared versions before 0.02 for Perl allow out-of-bounds reads and writes via unvalidated bucket, link and free-list indices in sph_walk_cell and sph_alloc_slot.
The attach-time validator sph_validate_header checks the header scalars and region layout against the file size, but does not validate the array contents it then trusts. sph_walk_cell reads entries[buckets[b]] and follows each entry's next link raw, and sph_alloc_slot writes through a file-stored free_head index, none bounded against the entry count (max_entries).
A local peer that can write the backing file can leave the header valid while poisoning the bucket chain and free list, so a query reads through an out-of-bounds bucket and next index and an insert writes through an out-of-bounds free-list head, corrupting memory or crashing the process.
The attach-time validator sph_validate_header checks the header scalars and region layout against the file size, but does not validate the array contents it then trusts. sph_walk_cell reads entries[buckets[b]] and follows each entry's next link raw, and sph_alloc_slot writes through a file-stored free_head index, none bounded against the entry count (max_entries).
A local peer that can write the backing file can leave the header valid while poisoning the bucket chain and free list, so a query reads through an out-of-bounds bucket and next index and an insert writes through an out-of-bounds free-list head, corrupting memory or crashing the process.
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
7.8
High
Type
CWE-125Out-of-bounds Read
CWE-787Out-of-bounds Write
Timeline
Published21 Jul 2026
Updated26 Oct 2026
First seen21 Jul 2026
Track software like this
Free during beta