CVE-2026-65061: Perl Data::ReqRep::Shared Info Disclosure

CVE-2026-65061 Overview

CVE-2026-65061 affects the Perl module Data::ReqRep::Shared in versions prior to 0.05. The module creates a memory-mapped backing file with world-readable permissions and opens it without the O_EXCL or O_NOFOLLOW flags. Any local user on the same host can read inter-process communication (IPC) payloads stored in the shared segment. A local attacker can also plant a symlink or file at the target path to redirect the open or win a pre-creation race. The weakness is tracked under CWE-59: Improper Link Resolution Before File Access.

Critical Impact
Local users can read IPC payloads from world-readable shared memory files and redirect file operations via symlink attacks in shared directories such as /tmp or /dev/shm.

Affected Products

Data::ReqRep::Shared for Perl, versions before 0.05
Applications embedding the vulnerable reqrep.h request-reply shared segment
Applications embedding the vulnerable integer-variant shared segment

Discovery Timeline

2026-07-21 - CVE-2026-65061 published to the National Vulnerability Database (NVD)
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-65061

Vulnerability Analysis

The vulnerability resides in reqrep.h, where the module creates the mmap backing file using open(path, O_RDWR | O_CREAT, 0666). This call is used for both the request-reply segment and the integer-variant segment. Two independent issues arise from this pattern.

First, the requested mode of 0666 combined with the common default umask 022 yields on-disk permissions of 0644. The segment file becomes world-readable, exposing any IPC payload written into the shared region to every local user account on the system.

Second, the absence of O_NOFOLLOW means the kernel follows symlinks at the path. The absence of O_EXCL means the open succeeds even when a file already exists at that path. An unprivileged local user who wins the pre-creation race can control the target file that the victim process ultimately writes to and reads from.

Root Cause

The root cause is unsafe file creation in a shared directory such as /tmp or /dev/shm. The code neither enforces exclusive creation nor refuses to follow symlinks, and it sets permissions broader than the confidentiality of IPC data warrants.

Attack Vector

Exploitation requires local access with the ability to write into the shared directory used for the segment. An attacker pre-creates a file or symlink at the predictable segment path. When the victim process launches, its open() call either follows the attacker-controlled symlink to a target of the attacker's choosing or reuses the pre-planted file. Because the segment remains world-readable, passive attackers can also simply read IPC payloads without any race.

No verified public exploit code is available for CVE-2026-65061. Refer to the MetaCPAN Version Diff for the exact source-level changes in reqrep.h.

Detection Methods for CVE-2026-65061

Indicators of Compromise

Unexpected symlinks in /tmp or /dev/shm pointing to sensitive files owned by other users
Shared segment files with mode 0644 or broader created by Perl processes using Data::ReqRep::Shared
Multiple processes from different users accessing the same segment path under a shared directory

Detection Strategies

Inventory Perl installations and locate Data::ReqRep::Shared modules with a version below 0.05 using cpan -D Data::ReqRep::Shared or CPAN metadata queries.
Audit filesystem activity for open() calls with O_CREAT on paths inside world-writable directories that omit O_EXCL and O_NOFOLLOW.
Review process file descriptor tables under /proc/*/maps and /proc/*/fd for shared segments backed by world-readable files.

Monitoring Recommendations

Log symlink creations in /tmp and /dev/shm and alert on links whose target is a file owned by a different user.
Track file creations in shared directories with permissions of 0644 or broader that originate from Perl interpreter processes.
Correlate cross-user reads of the same segment path within short time windows to surface potential IPC snooping.

How to Mitigate CVE-2026-65061

Immediate Actions Required

Upgrade Data::ReqRep::Shared to version 0.05 or later on every host running the module.
Enumerate dependent applications and restart them after upgrade so they load the patched module.
Remove any existing world-readable segment files left by prior versions in /tmp and /dev/shm.

Patch Information

The maintainer released Data::ReqRep::Shared 0.05, which corrects the unsafe open() call in reqrep.h. Review the fix in the MetaCPAN Changes Log and the source-level changes in the MetaCPAN Version Diff.

Workarounds

Relocate the segment backing file to a per-user directory that is not world-writable, such as a subdirectory under $HOME with mode 0700.
Tighten the process umask to 0077 before invoking any code that instantiates the shared segment, restricting on-disk permissions to 0600.
Use polyinstantiated /tmp (via pam_namespace) so each user receives an isolated temporary directory, preventing cross-user symlink planting.

bash

# Configuration example: install the fixed version and harden umask
cpanm Data::ReqRep::Shared@0.05
umask 0077