CVE-2026-59140

{
  "id": "CVE-2026-59140",
  "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
  "published": "2026-07-21T19:17:11.583",
  "lastModified": "2026-10-24T19:10:00.127",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Data::SortedSet::Shared versions before 0.03 for Perl allow an out-of-bounds read via unvalidated node indices in the rank and min/max query paths.\n\nThe attach-time validator ss_validate_header bounds only the root index against the node pool (node_capacity). The order-statistics and min/max queries then follow children[], leftmost and rightmost node indices read raw from the mmap'd segment without bounding them against node_capacity. A full structural check (ss_validate_tree) exists but runs only via an explicit validate method, not on attach.\n\nA local peer that can write the backing file can leave the header valid while poisoning the tree links, so the next rank, min or max query dereferences an out-of-bounds node index, reading adjacent memory or crashing the process."
    },
    {
      "lang": "es",
      "value": "Las versiones de Data::SortedSet::Shared anteriores a la 0.03 para Perl permiten una lectura fuera de límites a través de índices de nodo no validados en las rutas de consulta de rango y min/max.\n\nEl validador en tiempo de adjunción ss_validate_header limita solo el índice raíz contra el pool de nodos (node_capacity). Las consultas de estadísticas de orden y min/max luego siguen los índices de nodo children[], más a la izquierda y más a la derecha, leídos directamente del segmento mapeado en memoria sin limitarlos contra node_capacity. Una verificación estructural completa (ss_validate_tree) existe, pero se ejecuta solo a través de un método de validación explícito, no en la adjunción.\n\nUn par local que puede escribir el archivo de respaldo puede dejar el encabezado válido mientras corrompe los enlaces del árbol, de modo que la siguiente consulta de rango, min o max desreferencia un índice de nodo fuera de límites, leyendo memoria adyacente o bloqueando el proceso."
    }
  ],
  "affected": [
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "affectedData": [
        {
          "vendor": "EGOR",
          "product": "Data::SortedSet::Shared",
          "defaultStatus": "unaffected",
          "collectionURL": "https://cpan.org/modules",
          "packageName": "Data-SortedSet-Shared",
          "programFiles": [
            "sortedset.h"
          ],
          "programRoutines": [
            {
              "name": "ss_rank_of"
            },
            {
              "name": "ss_pop_locked"
            }
          ],
          "repo": "https://github.com/vividsnow/perl5-data-sortedset-shared",
          "versions": [
            {
              "version": "0",
              "lessThan": "0.03",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-22T19:17:36.844842Z",
          "id": "CVE-2026-59140",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-125"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://metacpan.org/release/EGOR/Data-SortedSet-Shared-0.03/changes",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    },
    {
      "url": "https://metacpan.org/release/EGOR/Data-SortedSet-Shared-0.03/diff/EGOR/Data-SortedSet-Shared-0.02#sortedset.h",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    }
  ]
}