EGOR Data::SpatialHash::Shared up to 0.01 sphash.h sph_walk_cell/sph_alloc_slot bucket/link/free_list out-of-bounds

Summaryinfo

A vulnerability was found in EGOR Data::SpatialHash::Shared up to 0.01. It has been rated as problematic. This affects the function sph_walk_cell/sph_alloc_slot of the file sphash.h. This manipulation of the argument bucket/link/free_list causes out-of-bounds. This vulnerability is handled as CVE-2026-59146. It is possible to launch the attack on the local host. There is not any exploit available.

Detailsinfo

A vulnerability was found in EGOR Data::SpatialHash::Shared up to 0.01. It has been declared as problematic. Affected by this vulnerability is the function sph_walk_cell/sph_alloc_slot of the file sphash.h. The manipulation of the argument bucket/link/free_list with an unknown input leads to a out-of-bounds vulnerability. The CWE definition for the vulnerability is CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Data::SpatialHash::Shared versions before 0.02 for Perl allow out-of-bounds reads and writes via unvalidated bucket, link and free-list indices in sph_walk_cell and sph_alloc_slot. The attach-time validator sph_validate_header checks the header scalars and region layout against the file size, but does not validate the array contents it then trusts. sph_walk_cell reads entries[buckets[b]] and follows each entry's next link raw, and sph_alloc_slot writes through a file-stored free_head index, none bounded against the entry count (max_entries). A local peer that can write the backing file can leave the header valid while poisoning the bucket chain and free list, so a query reads through an out-of-bounds bucket and next index and an insert writes through an out-of-bounds free-list head, corrupting memory or crashing the process.

It is possible to read the advisory at metacpan.org. This vulnerability is known as CVE-2026-59146 since 07/02/2026. The exploitation appears to be easy. Attacking locally is a requirement. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 0.02 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Programming Language Software

Vendor

• EGOR

Name

• Data::SpatialHash::Shared

Version

• 0.01

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion