CVE-2026-59140: Perl Data::SortedSet Use-After-Free Flaw

CVE-2026-59140 Overview

CVE-2026-59140 is an out-of-bounds read vulnerability in the Data::SortedSet::Shared Perl module before version 0.03. The module backs a sorted set with an mmap'd shared memory segment. On attach, the header validator ss_validate_header bounds only the root index against node_capacity. Order-statistics and min/max queries then follow children[], leftmost, and rightmost node indices read raw from the segment without bounding them against node_capacity. A local peer with write access to the backing file can poison tree links while keeping the header valid, so the next rank, min, or max query dereferences an out-of-bounds node index.

Critical Impact
An attacker with write access to the shared backing file can leak adjacent process memory or crash the reader process by corrupting internal tree indices.

Affected Products

Data::SortedSet::Shared for Perl versions before 0.03
Any Perl application attaching to a shared sorted-set segment produced by an untrusted writer
Distributions bundling the vulnerable CPAN release EGOR/Data-SortedSet-Shared-0.02

Discovery Timeline

2026-07-21 - CVE-2026-59140 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-59140

Vulnerability Analysis

The vulnerability is an out-of-bounds read classified under [CWE-125]. The module maintains an order-statistics tree inside a shared memory segment. Nodes reference other nodes through integer indices stored in children[], leftmost, and rightmost fields of each node. Reader processes attach to the segment and expect the writer to maintain structural invariants. However, the attach-time validator performs only a superficial check that bounds the root index against node_capacity. Child pointers and extremum pointers inside individual nodes are trusted implicitly. Subsequent traversal in the rank, min, and max code paths dereferences these indices without any bounds check, producing reads outside the node pool.

Root Cause

The root cause is asymmetry between two validation routines. ss_validate_header enforces only that the tree root falls inside the node pool. A comprehensive walker, ss_validate_tree, does exist and would catch poisoned links, but it runs only when the caller explicitly invokes the validate method. Because attach does not call the full walker, malformed indices survive into query paths.

Attack Vector

A local peer that can write the backing file for the shared segment can craft node entries whose children[], leftmost, or rightmost fields point outside the allocated node pool while leaving the header fields intact. When the victim process next calls rank, min, or max, the traversal follows the poisoned index and reads adjacent memory. The result is either disclosure of process memory contents to the attacker through side channels or query outputs, or a crash of the reader process. Confidentiality and availability are directly affected. Integrity of the reader process state is not modified by the read itself.

See the MetaCPAN Version Diff for the header and traversal code changes that address this vulnerability.

Detection Methods for CVE-2026-59140

Indicators of Compromise

Unexpected SIGSEGV or SIGBUS crashes in Perl processes that call rank, min, or max on a Data::SortedSet::Shared handle.
Modifications to shared sorted-set backing files by users or processes other than the trusted writer.
Reader processes returning anomalous rank or extremum values that do not match the expected element set.

Detection Strategies

Audit dependency manifests such as cpanfile and Makefile.PL for Data::SortedSet::Shared at versions below 0.03.
Instrument the reader with a wrapper that calls the module's explicit validate method after each attach, before issuing queries.
Enable core dump collection and stack traces on affected services to capture faults in sortedset.h traversal routines.

Monitoring Recommendations

Track open, write, and mmap syscalls against shared sorted-set backing files using auditd or eBPF sensors.
Alert on any writer to the backing file whose UID does not match the expected producer identity.
Baseline query latency and crash rates in services using the module and alert on deviations that may indicate exploitation attempts.

How to Mitigate CVE-2026-59140

Immediate Actions Required

Upgrade Data::SortedSet::Shared to version 0.03 or later from CPAN.
Restrict filesystem permissions on shared backing files so that only the trusted writer process can modify them.
Call the module's explicit validate method after every attach until the upgrade is deployed.

Patch Information

The fix ships in Data-SortedSet-Shared-0.03 on CPAN. The updated sortedset.h bounds children[], leftmost, and rightmost indices against node_capacity during traversal. See the MetaCPAN Changes Log for the release notes and the MetaCPAN Version Diff for the code changes.

Workarounds

Place backing files on a directory readable only by the reader UID and writable only by the producer UID.
Invoke the full ss_validate_tree walker via the validate method immediately after attach and before any rank, min, or max query.
Isolate readers of untrusted shared segments in a sandbox that limits address space and denies further filesystem access.

bash

# Upgrade the module from CPAN
cpanm Data::SortedSet::Shared@0.03

# Restrict backing file permissions to the producer UID
chown producer:producer /var/run/sortedset.bin
chmod 640 /var/run/sortedset.bin