Out-of-Bounds Read Vulnerability in Data::HashMap::Shared for Perl

CVE-2026-59142

What is CVE-2026-59142?

Data::HashMap::Shared versions prior to 0.14 for Perl are vulnerable to an out-of-bounds read that can be triggered via an unvalidated arena offset and length in the function shm_str_copy. This vulnerability arises because the attach-time validator, shm_validate_header, only checks the header's integrity and not the contents of the array, leading to potential memory corruption. A local peer with rights to the backing file can manipulate the header while poisoning a record's offset and length. Consequently, operations such as iterating or draining the map could lead to reading beyond the intended memory bounds or potentially crash the process.

References