Data::DisjointSet::Shared versions before 0.02 for Perl allow out-of-bounds reads and writes via an unvalidated parent index in dsu_find
Summary
| CVE | CVE-2026-59147 |
|---|---|
| State | PUBLISHED |
| Assigner | CPANSec |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-07-21 20:17:03 UTC |
| Updated | 2026-07-21 20:17:03 UTC |
| Description | Data::DisjointSet::Shared versions before 0.02 for Perl allow out-of-bounds reads and writes via an unvalidated parent index in dsu_find. The attach-time validator dsu_validate_header checks the header scalars and region layout against the file size, but does not validate the array contents it then trusts. dsu_find walks and path-compresses parent[x] with x a raw file-stored index never bounded against the node count, so both the read and the compression write-back land out of bounds. A local peer that can write the backing file can leave the header valid while poisoning the parent array, so the next find or union both reads and writes through an out-of-bounds parent index, corrupting memory or crashing the process. |
Risk And Classification
Problem Types: CWE-125 | CWE-787 | CWE-787 CWE-787 Out-of-bounds Write | CWE-125 CWE-125 Out-of-bounds Read
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | EGOR | DataDisjointSetShared | affected 0.02 custom | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| metacpan.org/release/EGOR/Data-DisjointSet-Shared-0.02/diff/EGOR/Data-Disj... | 9b29abf9-4ab0-4765-b253-1875cd9b441e | metacpan.org | |
| metacpan.org/release/EGOR/Data-DisjointSet-Shared-0.02/changes | 9b29abf9-4ab0-4765-b253-1875cd9b441e | metacpan.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Additional Advisory Data
Solutions
CNA: Upgrade to Data::DisjointSet::Shared 0.02 or later, which bounds every parent index against the node count before using it.
Workarounds
CNA: For deployments that cannot upgrade to 0.02, place the backing file in a directory writable only by the owning user, so a local peer cannot tamper with the parent array that find and union traverse.
There are currently no legacy QID mappings associated with this CVE.