Out-of-Bounds Vulnerability in Data::DisjointSet::Shared by Perl

CVE-2026-59147

What is CVE-2026-59147?

The Data::DisjointSet::Shared module for Perl contains a vulnerability that allows for out-of-bounds reads and writes due to an unvalidated parent index in the dsu_find function. Specifically, the dsu_validate_header function checks the header and region layout against the file size without adequately validating the contents of the parent array. Local peers with write access to the backing file can manipulate the parent array while keeping the header valid, resulting in corrupt memory access during subsequent find or union operations, potentially leading to crashes or other severe disruptions.

References