CVE-2026-59147: Perl Data::DisjointSet Buffer Overflow

CVE-2026-59147 Overview

CVE-2026-59147 is an out-of-bounds read and write vulnerability in the Data::DisjointSet::Shared Perl module versions before 0.02. The flaw resides in the dsu_find function, which walks and path-compresses the parent[x] array using a raw file-stored index that is never bounded against the node count. The attach-time validator dsu_validate_header checks header scalars and region layout against the file size but does not validate the array contents it subsequently trusts. A local peer with write access to the backing file can poison the parent array while keeping the header valid, causing subsequent find or union operations to read and write memory out of bounds.

Critical Impact
Attackers can corrupt process memory or crash Perl applications that consume shared disjoint-set files, enabling denial of service and potential code execution paths via out-of-bounds memory writes [CWE-125].

Affected Products

Data::DisjointSet::Shared for Perl, all versions before 0.02
Perl applications embedding this module for shared disjoint-set (union-find) data structures
Systems where untrusted local peers can write to the module's backing file

Discovery Timeline

2026-07-21 - CVE-2026-59147 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-59147

Vulnerability Analysis

The Data::DisjointSet::Shared module implements a disjoint-set union (DSU) data structure backed by a shared file, allowing multiple Perl processes to cooperate on union-find operations. The module relies on dsu_validate_header to confirm structural sanity of the backing file when it is attached. This validator confirms header scalars and computed region offsets fit within the file size, but stops short of inspecting the parent array entries stored in the region it just validated.

dsu_find then treats those parent entries as trusted indices. It reads parent[x], follows the chain to the representative, and writes back compressed pointers along the traversal. Because x originates from file-stored data with no upper bound check against the node count, both the dereference and the path-compression write can land outside the parent array. The bug is classified as an out-of-bounds read [CWE-125] but the same code path also performs an out-of-bounds write during path compression.

Root Cause

The root cause is missing input validation on array contents. The header validator confirms geometry but does not iterate the parent array to ensure every stored index is less than the node count. Trust is placed on data the attacker controls.

Attack Vector

A local peer with write access to the backing file crafts a valid header but embeds an oversized index in parent[]. When another process calls find or union, dsu_find dereferences and writes through that unvalidated index, corrupting adjacent memory in the mapped region or the surrounding heap.

No public proof-of-concept exploit code is available. See the MetaCPAN Release Diff for the exact source-level changes that introduce bounds checking.

Detection Methods for CVE-2026-59147

Indicators of Compromise

Unexpected crashes or SIGSEGV signals in Perl processes that call Data::DisjointSet::Shared methods such as find or union
Backing files owned by unexpected users or modified by processes outside the intended application group
Parent array entries in DSU backing files containing indices greater than or equal to the declared node count

Detection Strategies

Inventory installed Perl modules with cpan -l or corelist and flag Data::DisjointSet::Shared versions below 0.02
Enable core dumps for services using the module and inspect faulting addresses for out-of-bounds access patterns near mapped DSU regions
Add integrity validation that scans parent array entries against the declared node count before invoking find or union

Monitoring Recommendations

Audit file system permissions on DSU backing files and alert on writes by unexpected user IDs
Log crashes in Perl worker processes and correlate them with recent modifications to shared disjoint-set files
Monitor package management events for updates or downgrades of Data::DisjointSet::Shared across Perl deployments

How to Mitigate CVE-2026-59147

Immediate Actions Required

Upgrade Data::DisjointSet::Shared to version 0.02 or later on all systems running Perl workloads that use the module
Restrict write permissions on DSU backing files to a single trusted process identity
Move backing files off world-writable or group-writable directories and onto isolated storage paths

Patch Information

Upgrade to Data::DisjointSet::Shared version 0.02, which adds bounds validation for parent indices consumed by dsu_find. Refer to the MetaCPAN Release Changes for the fix summary and the MetaCPAN Release Diff for the source-level changes.

Workarounds

Place DSU backing files in directories accessible only to the owning process user and revoke group and other write bits
Wrap calls to find and union with application-level validation that rejects parent indices greater than or equal to the node count
Disable use of Data::DisjointSet::Shared in multi-tenant environments where untrusted local peers may write shared files

bash

# Upgrade the vulnerable module via cpanm
cpanm Data::DisjointSet::Shared@0.02

# Restrict backing file permissions to the owning service account
chown appuser:appuser /var/lib/myapp/dsu.bin
chmod 600 /var/lib/myapp/dsu.bin