CVE-2026-59139: Perl Data::ReqRep::Shared Buffer Overflow

CVE-2026-59139 Overview

CVE-2026-59139 is an out-of-bounds read vulnerability in the Perl module Data::ReqRep::Shared before version 0.05. The flaw resides in reqrep_recv_locked, which trusts arena offset and length values read directly from an mmap'd shared segment. The attach-time validator reqrep_validate_header verifies header scalars and region layout against file size but does not validate the array contents it subsequently trusts. A peer with write access to the backing file can poison a request slot to read adjacent process memory or crash the receiver. The issue is tracked as [CWE-125] Out-of-Bounds Read.

Critical Impact
An attacker who can write the shared backing file can force memcpy to read from a file-controlled offset and length, exposing adjacent memory or terminating the receiving process.

Affected Products

Data::ReqRep::Shared for Perl, all versions prior to 0.05
Perl applications that consume shared request/reply arenas through this module
Multi-process deployments where peers share a writable backing file

Discovery Timeline

2026-07-21 - CVE-2026-59139 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-59139

Vulnerability Analysis

The module implements a shared-memory request/reply mechanism backed by an mmap'd file. On attach, reqrep_validate_header inspects header scalars and region layout to confirm the mapped segment matches expected sizes. That validator does not re-check per-slot metadata inside the arena at receive time.

When reqrep_recv_locked processes an incoming request, it executes memcpy(copy_buf, req_arena + arena_off, len). Both arena_off and len are read raw from the shared segment and are never bounded against the arena capacity req_arena_cap. Any peer with write access to the backing file can leave the header structurally valid while corrupting a slot's offset and length fields, redirecting the copy to read outside the arena.

The result is disclosure of adjacent process memory into copy_buf or a crash when the read touches unmapped pages. This affects confidentiality and availability of the receiving Perl process.

Root Cause

The root cause is missing bounds validation on untrusted metadata inside a mapped region. The design trusts the arena contents after header validation, treating the file as authoritative even though a local peer may have written attacker-controlled values into slot offset and length fields.

Attack Vector

Exploitation requires the ability to write to the shared backing file used by Data::ReqRep::Shared. A local peer, or any process with equivalent filesystem access to the shared region, corrupts a request slot's arena_off and len. The next call to reqrep_recv_locked performs the unbounded memcpy, reading arbitrary in-process memory or faulting the receiver.

No authenticated code paths in the library validate arena_off + len <= req_arena_cap before the copy. See the MetaCPAN Release Diff for the corrected bounds check introduced in 0.05.

Detection Methods for CVE-2026-59139

Indicators of Compromise

Unexpected crashes or SIGSEGV termination of Perl processes that link Data::ReqRep::Shared versions below 0.05
Anomalous read patterns from mmap'd regions backing shared request/reply files
Writes to shared arena files originating from processes not part of the expected request/reply peer set
Perl process memory contents appearing in reply buffers received by peers

Detection Strategies

Inventory installed CPAN modules and flag any Data::ReqRep::Shared release with version < 0.05
Monitor filesystem access to shared backing files and correlate with the process list of legitimate peers
Instrument the receiver with runtime bounds checks or ASan builds during testing to surface out-of-bounds reads before deployment

Monitoring Recommendations

Alert on repeated abnormal termination of Perl workers using this module
Log and review any process opening the shared arena file for write access
Track deployment of the 0.05 release across all hosts through configuration management inventory

How to Mitigate CVE-2026-59139

Immediate Actions Required

Upgrade Data::ReqRep::Shared to version 0.05 or later on every host that runs the module
Restrict write permissions on the shared backing file to only the trusted process set
Audit existing deployments for unauthorized writers to the arena file
Restart Perl services after upgrade to ensure the patched code path is loaded

Patch Information

The fix ships in Data::ReqRep::Shared version 0.05, which adds validation of arena_off and len against req_arena_cap before the memcpy call in reqrep_recv_locked. Details are documented in the MetaCPAN Release Changes and the MetaCPAN Release Diff.

Workarounds

Tighten filesystem permissions so only trusted peers hold write access to the shared arena file
Run producers and consumers under distinct user accounts with least-privilege ACLs on the backing file
Isolate services that use the module in dedicated namespaces or containers to shrink the local peer set

bash

# Upgrade to the patched release from CPAN
cpanm Data::ReqRep::Shared@0.05

# Verify installed version
perl -MData::ReqRep::Shared -E 'say $Data::ReqRep::Shared::VERSION'

# Restrict the shared backing file to the owning service account
chown reqrep:reqrep /var/run/reqrep/arena.bin
chmod 0600 /var/run/reqrep/arena.bin