PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-59141 EGOR CVE debrief

CVE-2026-59141 is an out-of-bounds read vulnerability in Data::RadixTree::Shared Perl versions before 0.02. The attach-time validator rdx_validate_header checks the header scalars and region layout against the file size but does not validate the node records it then trusts. A local peer that can write the backing file can leave the header valid while poisoning the node records, allowing a lookup to dereference an out-of-bounds node or arena index, reading adjacent memory or crashing the process. Users should update to prevent potential out-of-bounds read attacks.

Vendor
EGOR
Product
Data::RadixTree::Shared
CVSS
CRITICAL 9.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-21
Original CVE updated
2026-07-22
Advisory published
2026-07-21
Advisory updated
2026-07-22

Who should care

Users of Data::RadixTree::Shared Perl versions before 0.02, system administrators, and developers using this module should verify their installations and ensure proper validation of node records to prevent out-of-bounds read attacks.

Technical summary

The vulnerability exists in the rdx_find_locked function of Data::RadixTree::Shared Perl versions before 0.02. The function indexes nodes[cur].children[k] and reads each node's label_off and label_len raw from the mmap'd segment without bounding against the node count or arena size. This allows an attacker to manipulate node records, leading to out-of-bounds reads or process crashes. A local peer that can write the backing file can leave the header valid while poisoning the node records.

Defensive priority

High

Recommended defensive actions

  • Update Data::RadixTree::Shared to version 0.02 or later
  • Verify and validate node records in the rdx_find_locked function
  • Implement bounds checking for node and arena indices
  • Monitor for potential attacks on the backing file
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-07-21T19:17:11.697Z and last modified on 2026-07-22T20:17:02.357Z. The NVD entry is currently Deferred. Evidence is limited to CVE and NVD details. Defenders should verify node record validation and out-of-bounds read attacks. Limited source detail available.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-21T19:17:11.697Z and has not been modified since then. The NVD entry is currently Deferred.