CVE-2026-59146: Perl SpatialHash Buffer Overflow Flaw

CVE-2026-59146 Overview

CVE-2026-59146 affects Data::SpatialHash::Shared versions before 0.02 for Perl. The module fails to validate array contents when attaching to a shared spatial hash file. Attackers with local write access to the backing file can poison bucket chains and free-list heads. A subsequent query or insert then reads or writes memory outside the allocated entry table.

The flaw is classified under CWE-125 (Out-of-Bounds Read) and also permits out-of-bounds writes. Exploitation can corrupt process memory or crash Perl applications that consume the shared hash.

Critical Impact
A local peer with write access to the backing file can trigger out-of-bounds reads and writes in sph_walk_cell and sph_alloc_slot, leading to memory corruption or process crashes.

Affected Products

Data::SpatialHash::Shared for Perl, all versions before 0.02
Perl applications that attach to shared spatial hash files created or written by untrusted local peers
Systems where the backing file resides on a shared or writable filesystem location

Discovery Timeline

2026-07-21 - CVE-2026-59146 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-59146

Vulnerability Analysis

The vulnerability lives in the C-backed core of Data::SpatialHash::Shared, specifically in the routines sph_walk_cell and sph_alloc_slot. The module memory-maps a backing file that stores a header, bucket array, entry table, and free list. On attach, the module invokes sph_validate_header to confirm header scalars and region layout match the file size.

The validator stops at layout checks. It does not verify that array contents such as bucket heads, entry next pointers, or the free-list head point to valid entry indices. Downstream code trusts these indices as if they had been range-checked. Any untrusted content in the file is dereferenced directly against max_entries-sized arrays without a bounds test.

Queries call sph_walk_cell, which reads entries[buckets[b]] and follows the resulting next link raw. Inserts call sph_alloc_slot, which writes through a file-stored free_head index. Neither path constrains the index against the declared entry count.

Root Cause

The root cause is missing input validation on trusted-looking, file-resident indices. sph_validate_header treats the header and region layout as the sole trust boundary. The bucket array, entry next chain, and free-list head are consumed without bounds checks against max_entries. Because the backing file is mutable by any local peer with write permission, the integrity assumption underlying those reads and writes does not hold.

Attack Vector

A local attacker with write access to the backing file crafts a file whose header passes sph_validate_header but whose bucket table or free-list head references indices outside the entry array. When a legitimate consumer attaches and issues a lookup, sph_walk_cell reads past the entry table and dereferences an out-of-bounds next link. When the consumer performs an insert, sph_alloc_slot writes through the poisoned free_head, corrupting memory beyond the mapped entry region.

Exploitation requires local file write access and user interaction from the victim process that attaches to the shared file. The vulnerability manifests in the C boundary logic of sphash.h; refer to the MetaCPAN Release Diff for the corrected bounds checks.

Detection Methods for CVE-2026-59146

Indicators of Compromise

Unexpected crashes or SIGSEGV in Perl processes that link Data::SpatialHash::Shared and attach to a shared backing file.
Modifications to the shared hash backing file by user accounts other than the owning service identity.
Anomalous entries in the mapped file where bucket heads or free_head values exceed the declared max_entries value.

Detection Strategies

Audit filesystem permissions on backing files used by Data::SpatialHash::Shared consumers and alert when non-owner writes occur.
Instrument Perl workers with core dump collection to capture the offending stack frames in sph_walk_cell or sph_alloc_slot.
Run static inventory scans across Perl deployments to identify installed versions of Data::SpatialHash::Shared older than 0.02.

Monitoring Recommendations

Monitor for repeated process restarts of Perl services consuming shared spatial hash files, which can indicate exploitation attempts causing crashes.
Log open and write syscalls against known backing file paths and correlate with the expected writer process identity.
Track CPAN module inventory changes to detect upgrades or rollbacks of Data::SpatialHash::Shared across hosts.

How to Mitigate CVE-2026-59146

Immediate Actions Required

Upgrade Data::SpatialHash::Shared to version 0.02 or later on all Perl hosts that use the module.
Restrict write permissions on shared backing files to a single trusted service identity to eliminate the local-peer write vector.
Enumerate consumers of the module across production and lab environments to ensure no vulnerable copies remain.

Patch Information

The maintainer released Data-SpatialHash-Shared-0.02 on CPAN with bounds validation added to the affected code paths. The corrected implementation in sphash.h constrains bucket heads, entry next links, and free-list indices against max_entries before dereference. See the MetaCPAN Release Changes for the release notes and the MetaCPAN Release Diff for the source changes.

Workarounds

Place backing files on filesystems accessible only to the owning process, using strict Unix permissions or dedicated user namespaces.
Store backing files on a per-user tmpfs mount that no other local account can write to, until upgrade is possible.
Disable use of shared attach mode in applications that can operate on in-process spatial hashes only.

bash

# Configuration example: upgrade the module and lock down backing file permissions
cpanm Data::SpatialHash::Shared@0.02

# Restrict the shared backing file to the owning service account
chown svc-spatialhash:svc-spatialhash /var/lib/spatialhash/shared.sph
chmod 600 /var/lib/spatialhash/shared.sph