CVE-2026-59142 EGOR CVE debrief

Who should care

Users of Data::HashMap::Shared versions before 0.14 for Perl should be concerned about this vulnerability, as it can be exploited by a local peer to read sensitive information or crash the process. This vulnerability is particularly relevant for systems where untrusted users have local access.

Technical summary

The vulnerability exists in the Data::HashMap::Shared module for Perl, specifically in versions before 0.14. The issue arises from the lack of validation of array contents in the shm_validate_header function, which checks header scalars and region layout against the file size. The shm_str_copy function then performs a memcpy operation using an unvalidated arena offset and length, read raw from the mmap'd segment. This can lead to an out-of-bounds read, allowing an attacker to read adjacent memory or crash the process. The get path is not affected as it bounds off and len separately.

Defensive priority

High

Recommended defensive actions

• Update Data::HashMap::Shared to version 0.14 or later
• Restrict local access to the system to trusted users only
• Monitor for suspicious activity or crashes
• Implement additional security controls to prevent exploitation
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-07-21T19:17:11.800Z and was last modified on 2026-07-22T20:17:02.507Z. The NVD entry is currently Deferred. The vulnerability has a CVSS score of 9.1 and a severity of CRITICAL.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.