CVE-2026-59141

{
  "id": "CVE-2026-59141",
  "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
  "published": "2026-07-21T19:17:11.697",
  "lastModified": "2026-10-24T19:10:00.127",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Data::RadixTree::Shared versions before 0.02 for Perl allow an out-of-bounds read via unvalidated node and arena indices in rdx_find_locked.\n\nThe attach-time validator rdx_validate_header checks the header scalars and region layout against the file size, but does not validate the node records it then trusts. rdx_find_locked indexes nodes[cur].children[k] and reads each node's label_off and label_len raw from the mmap'd segment, none bounded against the node count or the arena size.\n\nA local peer that can write the backing file can leave the header valid while poisoning the node records, so a lookup dereferences an out-of-bounds node or arena index, reading adjacent memory or crashing the process."
    },
    {
      "lang": "es",
      "value": "Las versiones de Data::RadixTree::Shared anteriores a la 0.02 para Perl permiten una lectura fuera de límites a través de índices de nodo y arena no validados en rdx_find_locked.\n\nEl validador en tiempo de adjunción rdx_validate_header comprueba los escalares del encabezado y la disposición de la región contra el tamaño del archivo, pero no valida los registros de nodo en los que luego confía. rdx_find_locked indexa nodes[cur].children[k] y lee label_off y label_len de cada nodo en bruto del segmento mapeado en memoria, ninguno acotado contra el recuento de nodos o el tamaño de la arena.\n\nUn par local que puede escribir el archivo de respaldo puede dejar el encabezado válido mientras envenena los registros de nodo, por lo que una búsqueda desreferencia un índice de nodo o arena fuera de límites, leyendo memoria adyacente o bloqueando el proceso."
    }
  ],
  "affected": [
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "affectedData": [
        {
          "vendor": "EGOR",
          "product": "Data::RadixTree::Shared",
          "defaultStatus": "unaffected",
          "collectionURL": "https://cpan.org/modules",
          "packageName": "Data-RadixTree-Shared",
          "programFiles": [
            "radix.h"
          ],
          "programRoutines": [
            {
              "name": "rdx_find_locked"
            }
          ],
          "repo": "https://github.com/vividsnow/perl5-data-radixtree-shared",
          "versions": [
            {
              "version": "0",
              "lessThan": "0.02",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-22T19:18:47.435468Z",
          "id": "CVE-2026-59141",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-125"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://metacpan.org/release/EGOR/Data-RadixTree-Shared-0.02/changes",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    },
    {
      "url": "https://metacpan.org/release/EGOR/Data-RadixTree-Shared-0.02/diff/EGOR/Data-RadixTree-Shared-0.01#radix.h",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    }
  ]
}