CVE-2026-59142 in Data::HashMap::Shared
Summary
by MITRE • 07/21/2026
Data::HashMap::Shared versions before 0.14 for Perl allow an out-of-bounds read via an unvalidated arena offset and length in shm_str_copy.
The attach-time validator shm_validate_header checks the header scalars and region layout against the file size, but does not validate the array contents it then trusts. shm_str_copy does memcpy(dst, arena + off, len) with off and len read raw from the mmap'd segment and unbounded, on the each, keys, values, pop, shift, take, swap, drain and cursor paths. The get path bounds off and len separately and is not affected.
A local peer that can write the backing file can leave the header valid while poisoning a record's offset and length, so iterating or draining the map copies a file-controlled offset and length out of the arena, reading adjacent memory or crashing the process.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/21/2026
The vulnerability in Data::HashMap::Shared versions prior to 014 presents a critical out-of-bounds read condition that stems from insufficient input validation during shared memory segment processing. This flaw exists within the shm_str_copy function which performs direct memory copying operations without proper bounds checking of arena offsets and lengths. The security issue manifests when an attacker with write access to the backing file can manipulate the memory segment contents while maintaining valid header structures, creating a scenario where unvalidated data from the mmap'd region is used directly in memory copy operations.
The technical implementation of this vulnerability occurs at runtime during shared memory attachment when the shm_validate_header function performs initial validation checks against file size constraints but fails to validate the array contents within the memory segment. This validation gap allows malicious actors to corrupt individual record metadata while keeping the overall header structure intact, enabling exploitation through what appears to be legitimate memory access patterns. The vulnerability specifically affects multiple operational paths including keys, values, pop, shift, take, swap, drain, and cursor operations, where the shm_str_copy function executes memcpy(dst, arena + off, len) with unbounded offset and length parameters directly sourced from the mmap'd segment.
The operational impact of this vulnerability extends beyond simple memory corruption to potentially enable information disclosure or process termination through controlled memory reads. An attacker with local write access to the backing file can poison records by manipulating offset and length values, causing subsequent iteration or draining operations to copy memory regions that extend beyond intended boundaries. This behavior allows reading adjacent memory contents which may contain sensitive data, credentials, or system information, while also potentially triggering segmentation faults or other crashes that could be exploited for denial of service attacks.
The vulnerability aligns with CWE-129 Input Validation and CWE-787 Out-of-bounds Write categories, representing a classic case where insufficient validation leads to memory safety issues. From an ATT&CK perspective, this represents a privilege escalation vector through local file system manipulation, potentially enabling information gathering and system reconnaissance activities. The attack requires local write access to the shared memory backing file but does not require elevated privileges, making it particularly concerning in multi-user environments where such file access might be possible.
Mitigation strategies should focus on implementing comprehensive input validation for all memory segment parameters before any memory copying operations occur, including bounds checking against the actual memory segment size and proper validation of array contents. The fix should involve modifying the shm_str_copy function to validate offset and length values against the available memory region boundaries, ensuring that all inputs are properly sanitized regardless of header validity. Additionally, implementing defensive programming practices such as using safe memory copy functions with explicit bounds checking would significantly reduce the risk exposure. System administrators should also consider restricting write access to shared memory backing files when possible, and monitoring for unauthorized file modifications in environments where this vulnerability might be exploited.