CVE-2026-59140 in Data::SortedSet::Shared
Summary
by MITRE • 07/21/2026
Data::SortedSet::Shared versions before 0.03 for Perl allow an out-of-bounds read via unvalidated node indices in the rank and min/max query paths.
The attach-time validator ss_validate_header bounds only the root index against the node pool (node_capacity). The order-statistics and min/max queries then follow children[], leftmost and rightmost node indices read raw from the mmap'd segment without bounding them against node_capacity. A full structural check (ss_validate_tree) exists but runs only via an explicit validate method, not on attach.
A local peer that can write the backing file can leave the header valid while poisoning the tree links, so the next rank, min or max query dereferences an out-of-bounds node index, reading adjacent memory or crashing the process.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/21/2026
The vulnerability in Data::SortedSet::Shared versions prior to 003 represents a critical out-of-bounds memory access flaw that can lead to arbitrary code execution or denial of service. This issue stems from insufficient validation of node indices during query operations, specifically affecting rank and min/max query paths within the sorted set data structure. The vulnerability is classified under CWE-129 as an "Improper Validation of Array Index" and can be mapped to ATT&CK technique T1059.007 for execution through Perl scripting environments.
The core technical flaw exists in the validation mechanism that only performs bounds checking on the root index against the node pool capacity during attachment time via ss_validate_header function. However, subsequent order-statistics and min/max queries do not perform similar validation checks on children[], leftmost, and rightmost node indices that are directly read from memory-mapped segments without proper bounds verification. This discrepancy creates a path where malicious input can corrupt internal tree links while maintaining valid header information.
The operational impact of this vulnerability is severe as it allows local attackers with write access to the backing file to craft malicious data structures that appear valid to the initial header validation but contain corrupted tree link references. When legitimate rank, min, or max queries are executed against such poisoned data, the system follows invalid node indices that point outside the allocated node pool boundaries. This results in out-of-bounds memory reads that can expose sensitive data from adjacent memory regions or cause process crashes through segmentation faults.
The vulnerability chain begins with a successful bypass of automatic validation since ss_validate_tree function only executes when explicitly called via validate method, not during normal attachment procedures. This design flaw means that even if an attacker cannot directly execute arbitrary code, they can still manipulate the underlying data structure to trigger memory corruption during legitimate query processing. The memory-mapped segment approach amplifies the risk as it allows direct pointer manipulation in shared memory contexts.
Mitigation strategies must address both the immediate validation gap and the broader architectural issues within the library. Implementing comprehensive bounds checking on all node indices during query execution, regardless of whether they come from header validation or tree traversal paths, is essential. Additionally, the automatic validation mechanism should be made mandatory rather than optional to prevent accidental bypasses. The fix should also consider implementing proper memory isolation techniques and input sanitization routines that align with security best practices outlined in OWASP Top Ten and NIST Cybersecurity Framework guidelines.