EGOR Data::HashMap::Shared up to 0.13 shm_validate_header shm_generic.h shm_str_copy off/len out-of-bounds

Summaryinfo

A vulnerability, which was classified as problematic, has been found in EGOR Data::HashMap::Shared up to 0.13. The impacted element is the function shm_str_copy of the file shm_generic.h of the component shm_validate_header. This manipulation of the argument off/len causes out-of-bounds. This vulnerability is registered as CVE-2026-59142. The attack needs to be launched locally. No exploit is available.

Detailsinfo

A vulnerability classified as problematic was found in EGOR Data::HashMap::Shared up to 0.13. Affected by this vulnerability is the function shm_str_copy of the file shm_generic.h of the component shm_validate_header. The manipulation of the argument off/len with an unknown input leads to a out-of-bounds vulnerability. The CWE definition for the vulnerability is CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Data::HashMap::Shared versions before 0.14 for Perl allow an out-of-bounds read via an unvalidated arena offset and length in shm_str_copy. The attach-time validator shm_validate_header checks the header scalars and region layout against the file size, but does not validate the array contents it then trusts. shm_str_copy does memcpy(dst, arena + off, len) with off and len read raw from the mmap'd segment and unbounded, on the each, keys, values, pop, shift, take, swap, drain and cursor paths. The get path bounds off and len separately and is not affected. A local peer that can write the backing file can leave the header valid while poisoning a record's offset and length, so iterating or draining the map copies a file-controlled offset and length out of the arena, reading adjacent memory or crashing the process.

The advisory is shared at metacpan.org. This vulnerability is known as CVE-2026-59142 since 07/02/2026. The exploitation appears to be easy. An attack has to be approached locally. Technical details are known, but no exploit is available.

Upgrading to version 0.14 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• EGOR

Name

• Data::HashMap::Shared

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9
• 0.10
• 0.11
• 0.12
• 0.13

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion