CVE-2026-59142: Perl Data::HashMap::Shared Vulnerability

CVE-2026-59142 Overview

CVE-2026-59142 is an out-of-bounds read vulnerability in the Data::HashMap::Shared Perl module in versions before 0.14. The flaw resides in the shm_str_copy function, which trusts unvalidated arena offset and length values read from a shared memory segment. A local peer with write access to the backing file can poison record offsets and lengths while keeping the header valid. When the map is iterated or drained, the process reads adjacent memory or crashes. The vulnerability is tracked under [CWE-125: Out-of-Bounds Read].

Critical Impact
Local attackers who can write to the shared memory backing file can trigger reads of adjacent process memory, leading to information disclosure or process crashes.

Affected Products

Data::HashMap::Shared for Perl, all versions prior to 0.14
Perl applications consuming shared memory maps through this module
Multi-process systems relying on the module for inter-process communication

Discovery Timeline

2026-07-21 - CVE-2026-59142 published to the National Vulnerability Database (NVD)
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-59142

Vulnerability Analysis

The vulnerability affects Data::HashMap::Shared, a Perl module that provides a hash map interface backed by shared memory. The attach-time validator shm_validate_header inspects header scalars and region layout against the file size. However, it does not validate the array contents that downstream operations trust.

The shm_str_copy function performs memcpy(dst, arena + off, len) where both off and len are read raw from the mmap'd segment. These values remain unbounded on the each, keys, values, pop, shift, take, swap, drain, and cursor code paths. The get path independently bounds off and len and is not affected.

Root Cause

The root cause is missing input validation on attacker-controllable data structures stored in shared memory. The header validator establishes trust in the overall region layout but does not extend those checks to per-record offset and length fields. Subsequent code paths dereference these fields as trusted, violating the boundary between validated metadata and unvalidated payload data.

Attack Vector

A local peer that can write to the backing file used by the shared memory map crafts a malicious record. The attacker keeps the header valid so shm_validate_header passes, then writes a poisoned offset and length into an individual record. When the victim process iterates, drains, or otherwise traverses the map through an affected code path, shm_str_copy reads from a file-controlled memory location. The result is either information disclosure through leaked adjacent memory or a denial of service through a segmentation fault.

No verified exploitation code is publicly available. See the MetaCPAN Release Diff Comparison for the technical patch details.

Detection Methods for CVE-2026-59142

Indicators of Compromise

Unexpected crashes or SIGSEGV signals in Perl processes using Data::HashMap::Shared
Modifications to shared memory backing files by processes outside the expected trust boundary
Anomalous read patterns from mmap'd regions correlated with map iteration operations

Detection Strategies

Audit installed Perl module inventories for Data::HashMap::Shared versions below 0.14
Monitor file integrity on shared memory backing files used by Perl applications
Instrument affected applications with memory sanitizers during testing to surface out-of-bounds reads on iteration paths

Monitoring Recommendations

Log all writes to shared memory backing files and alert on writes from unexpected user identifiers
Track process crash telemetry for Perl workloads and correlate with map iteration workflows
Enable auditd rules on files backing shared memory regions to detect tampering attempts

How to Mitigate CVE-2026-59142

Immediate Actions Required

Upgrade Data::HashMap::Shared to version 0.14 or later on all Perl hosts using the module
Restrict write permissions on shared memory backing files to trusted principals only
Review CPAN dependency manifests and rebuild containers or packages that bundle the vulnerable version

Patch Information

The maintainer released version 0.14 which adds bounds checks to off and len on the affected iteration and drain paths. Review the MetaCPAN Release Changes for the full changelog and the MetaCPAN Release Diff Comparison to inspect the specific code changes in shm_generic.h.

Workarounds

Restrict filesystem permissions on the shared memory backing file to the owning process user only
Constrain application logic to the get code path, which validates off and len independently, until the upgrade completes
Run affected Perl processes under mandatory access control profiles that isolate the backing file from other local users

bash

# Upgrade Data::HashMap::Shared to the patched release
cpanm Data::HashMap::Shared@0.14

# Verify installed version
perl -MData::HashMap::Shared -e 'print $Data::HashMap::Shared::VERSION, "\n"'

# Restrict backing file permissions
chmod 0600 /path/to/shm/backing/file