CVE-2026-59146 EGOR CVE debrief

Who should care

Users of the Data::SpatialHash::Shared Perl module, particularly those using versions before 0.02, should be aware of this vulnerability and take steps to mitigate it. This includes operators, platform administrators, vulnerability management teams, and security teams who may be impacted by the vulnerability.

Technical summary

The vulnerability is caused by a lack of validation in the sph_walk_cell and sph_alloc_slot functions, which allow out-of-bounds reads and writes. The attach-time validator sph_validate_header checks the header scalars and region layout against the file size but does not validate the array contents. A local peer that can write the backing file can leave the header valid while poisoning the bucket chain and free list, allowing a query to read through an out-of-bounds bucket and next index, and an insert to write through an out-of-bounds free-list head.

Defensive priority

High

Recommended defensive actions

• Update to version 0.02 or later of the Data::SpatialHash::Shared Perl module
• Validate input to the sph_walk_cell and sph_alloc_slot functions
• Use compensating controls to prevent exploitation
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record was published on 2026-07-21T20:17:03.407Z and last modified on 2026-07-22T20:17:02.970Z. The NVD entry is currently Deferred. There is limited information available about the vulnerability, and defenders should verify the affected scope and severity with the vendor. The vulnerability affects Data::SpatialHash::Shared Perl module versions before 0.02.

Official resources