CVE-2026-59140

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-59140", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "state": "PUBLISHED", "assignerShortName": "CPANSec", "dateReserved": "2026-07-02T16:24:17.912Z", "datePublished": "2026-07-21T19:03:16.345Z", "dateUpdated": "2026-07-22T19:18:01.325Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "Data-SortedSet-Shared", "product": "Data::SortedSet::Shared", "programFiles": ["sortedset.h"], "programRoutines": [{"name": "ss_rank_of"}, {"name": "ss_pop_locked"}], "repo": "https://github.com/vividsnow/perl5-data-sortedset-shared", "vendor": "EGOR", "versions": [{"lessThan": "0.03", "status": "affected", "version": "0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "Data::SortedSet::Shared versions before 0.03 for Perl allow an out-of-bounds read via unvalidated node indices in the rank and min/max query paths.\n\nThe attach-time validator ss_validate_header bounds only the root index against the node pool (node_capacity). The order-statistics and min/max queries then follow children[], leftmost and rightmost node indices read raw from the mmap'd segment without bounding them against node_capacity. A full structural check (ss_validate_tree) exists but runs only via an explicit validate method, not on attach.\n\nA local peer that can write the backing file can leave the header valid while poisoning the tree links, so the next rank, min or max query dereferences an out-of-bounds node index, reading adjacent memory or crashing the process."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-07-21T19:03:16.345Z"}, "references": [{"url": "https://metacpan.org/release/EGOR/Data-SortedSet-Shared-0.03/diff/EGOR/Data-SortedSet-Shared-0.02#sortedset.h"}, {"tags": ["release-notes"], "url": "https://metacpan.org/release/EGOR/Data-SortedSet-Shared-0.03/changes"}], "solutions": [{"lang": "en", "value": "Upgrade to Data::SortedSet::Shared 0.03 or later, which bounds every node index against the node pool before dereferencing it."}], "source": {"discovery": "UNKNOWN"}, "title": "Data::SortedSet::Shared versions before 0.03 for Perl allow an out-of-bounds read via unvalidated node indices in the rank and min/max query paths", "workarounds": [{"lang": "en", "value": "For deployments that cannot upgrade to 0.03, place the backing file in a directory writable only by the owning user, so a local peer cannot tamper with the tree the query paths traverse."}], "x_generator": {"engine": "cpansec-cna-tool 0.1"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-07-22T19:17:36.844842Z", "id": "CVE-2026-59140", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-22T19:18:01.325Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-59140", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-22T19:17:36.844842Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-22T19:17:25.615Z"}}], "cna": {"title": "Data::SortedSet::Shared versions before 0.03 for Perl allow an out-of-bounds read via unvalidated node indices in the rank and min/max query paths", "source": {"discovery": "UNKNOWN"}, "affected": [{"repo": "https://github.com/vividsnow/perl5-data-sortedset-shared", "vendor": "EGOR", "product": "Data::SortedSet::Shared", "versions": [{"status": "affected", "version": "0", "lessThan": "0.03", "versionType": "custom"}], "packageName": "Data-SortedSet-Shared", "programFiles": ["sortedset.h"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "ss_rank_of"}, {"name": "ss_pop_locked"}]}], "solutions": [{"lang": "en", "value": "Upgrade to Data::SortedSet::Shared 0.03 or later, which bounds every node index against the node pool before dereferencing it."}], "references": [{"url": "https://metacpan.org/release/EGOR/Data-SortedSet-Shared-0.03/diff/EGOR/Data-SortedSet-Shared-0.02#sortedset.h"}, {"url": "https://metacpan.org/release/EGOR/Data-SortedSet-Shared-0.03/changes", "tags": ["release-notes"]}], "workarounds": [{"lang": "en", "value": "For deployments that cannot upgrade to 0.03, place the backing file in a directory writable only by the owning user, so a local peer cannot tamper with the tree the query paths traverse."}], "x_generator": {"engine": "cpansec-cna-tool 0.1"}, "descriptions": [{"lang": "en", "value": "Data::SortedSet::Shared versions before 0.03 for Perl allow an out-of-bounds read via unvalidated node indices in the rank and min/max query paths.\n\nThe attach-time validator ss_validate_header bounds only the root index against the node pool (node_capacity). The order-statistics and min/max queries then follow children[], leftmost and rightmost node indices read raw from the mmap'd segment without bounding them against node_capacity. A full structural check (ss_validate_tree) exists but runs only via an explicit validate method, not on attach.\n\nA local peer that can write the backing file can leave the header valid while poisoning the tree links, so the next rank, min or max query dereferences an out-of-bounds node index, reading adjacent memory or crashing the process."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-07-21T19:03:16.345Z"}}}, "cveMetadata": {"cveId": "CVE-2026-59140", "state": "PUBLISHED", "dateUpdated": "2026-07-22T19:18:01.325Z", "dateReserved": "2026-07-02T16:24:17.912Z", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "datePublished": "2026-07-21T19:03:16.345Z", "assignerShortName": "CPANSec"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "Data-SortedSet-Shared", "product": "Data::SortedSet::Shared", "programFiles": ["sortedset.h"], "programRoutines": [{"name": "ss_rank_of"}, {"name": "ss_pop_locked"}], "repo": "https://github.com/vividsnow/perl5-data-sortedset-shared", "vendor": "EGOR", "versions": [{"lessThan": "0.03", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Data::SortedSet::Shared versions before 0.03 for Perl allow an out-of-bounds read via unvalidated node indices in the rank and min/max query paths.\n\nThe attach-time validator ss_validate_header bounds only the root index against the node pool (node_capacity). The order-statistics and min/max queries then follow children[], leftmost and rightmost node indices read raw from the mmap'd segment without bounding them against node_capacity. A full structural check (ss_validate_tree) exists but runs only via an explicit validate method, not on attach.\n\nA local peer that can write the backing file can leave the header valid while poisoning the tree links, so the next rank, min or max query dereferences an out-of-bounds node index, reading adjacent memory or crashing the process."}, {"lang": "es", "value": "Las versiones de Data::SortedSet::Shared anteriores a la 0.03 para Perl permiten una lectura fuera de l\u00edmites a trav\u00e9s de \u00edndices de nodo no validados en las rutas de consulta de rango y min/max.\n\nEl validador en tiempo de adjunci\u00f3n ss_validate_header limita solo el \u00edndice ra\u00edz contra el pool de nodos (node_capacity). Las consultas de estad\u00edsticas de orden y min/max luego siguen los \u00edndices de nodo children[], m\u00e1s a la izquierda y m\u00e1s a la derecha, le\u00eddos directamente del segmento mapeado en memoria sin limitarlos contra node_capacity. Una verificaci\u00f3n estructural completa (ss_validate_tree) existe, pero se ejecuta solo a trav\u00e9s de un m\u00e9todo de validaci\u00f3n expl\u00edcito, no en la adjunci\u00f3n.\n\nUn par local que puede escribir el archivo de respaldo puede dejar el encabezado v\u00e1lido mientras corrompe los enlaces del \u00e1rbol, de modo que la siguiente consulta de rango, min o max desreferencia un \u00edndice de nodo fuera de l\u00edmites, leyendo memoria adyacente o bloqueando el proceso."}], "id": "CVE-2026-59140", "lastModified": "2026-10-24T19:10:00.127", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-59140", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-22T19:17:36.844842Z", "version": "2.0.3"}}]}, "published": "2026-07-21T19:17:11.583", "references": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://metacpan.org/release/EGOR/Data-SortedSet-Shared-0.03/changes"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://metacpan.org/release/EGOR/Data-SortedSet-Shared-0.03/diff/EGOR/Data-SortedSet-Shared-0.02#sortedset.h"}], "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,0.03)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Data::SortedSet::Shared", "source": "cna", "vendor": "EGOR"}, "product": "data::sortedset::shared", "vendor": "egor"}], "created": "2026-07-23T21:13:17.844797+00:00", "updated": "2026-08-04T18:00:14.139928+00:00", "vendors": ["egor", "egor$PRODUCT$data::sortedset::shared"]}