Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
4 vulnerabilities found for Data::SortedSet::Shared by EGOR
CVE-2026-65062 (GCVE-0-2026-65062)
Vulnerability from nvd – Published: 2026-07-21 19:08 – Updated: 2026-07-21 19:08
VLAI
EPSS
VEX
Title
Data::SortedSet::Shared versions before 0.03 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW
Summary
Data::SortedSet::Shared versions before 0.03 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW.
The segment is created in sortedset.h with open(path, O_RDWR|O_CREAT, 0666). The mode is 0666, so under the default umask 022 the file is created mode 0644 (world-readable). O_NOFOLLOW is absent, so a symlink planted at the path is followed, and O_EXCL is absent, so the open silently uses a pre-planted file instead of failing.
A "Shared" segment naturally lives in a shared directory such as /tmp or /dev/shm, where any local user can read the IPC payloads stored in the world-readable segment, and a pre-planted file or symlink at the path lets a local attacker win a pre-creation race or redirect the open.
Severity
No CVSS data available.
CWE
Assigner
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| EGOR | Data::SortedSet::Shared |
Affected:
0 , < 0.03
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://cpan.org/modules",
"defaultStatus": "unaffected",
"packageName": "Data-SortedSet-Shared",
"product": "Data::SortedSet::Shared",
"programFiles": [
"sortedset.h"
],
"repo": "https://github.com/vividsnow/perl5-data-sortedset-shared",
"vendor": "EGOR",
"versions": [
{
"lessThan": "0.03",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Data::SortedSet::Shared versions before 0.03 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW.\n\nThe segment is created in sortedset.h with open(path, O_RDWR|O_CREAT, 0666). The mode is 0666, so under the default umask 022 the file is created mode 0644 (world-readable). O_NOFOLLOW is absent, so a symlink planted at the path is followed, and O_EXCL is absent, so the open silently uses a pre-planted file instead of failing.\n\nA \"Shared\" segment naturally lives in a shared directory such as /tmp or /dev/shm, where any local user can read the IPC payloads stored in the world-readable segment, and a pre-planted file or symlink at the path lets a local attacker win a pre-creation race or redirect the open."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-732",
"description": "CWE-732 Incorrect Permission Assignment for Critical Resource",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-59",
"description": "CWE-59 Improper Link Resolution Before File Access",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-21T19:08:01.856Z",
"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"shortName": "CPANSec"
},
"references": [
{
"url": "https://metacpan.org/release/EGOR/Data-SortedSet-Shared-0.03/diff/EGOR/Data-SortedSet-Shared-0.02#sortedset.h"
},
{
"tags": [
"release-notes"
],
"url": "https://metacpan.org/release/EGOR/Data-SortedSet-Shared-0.03/changes"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to Data::SortedSet::Shared 0.03 or later, which creates the backing file mode 0600 (owner-only) with O_EXCL and O_NOFOLLOW."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Data::SortedSet::Shared versions before 0.03 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW",
"workarounds": [
{
"lang": "en",
"value": "For deployments that cannot upgrade to 0.03, set a restrictive umask so the backing file is not world-readable and place it in a directory only the owning user can access."
}
],
"x_generator": {
"engine": "cpansec-cna-tool 0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"assignerShortName": "CPANSec",
"cveId": "CVE-2026-65062",
"datePublished": "2026-07-21T19:08:01.856Z",
"dateReserved": "2026-07-21T15:29:37.116Z",
"dateUpdated": "2026-07-21T19:08:01.856Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59140 (GCVE-0-2026-59140)
Vulnerability from nvd – Published: 2026-07-21 19:03 – Updated: 2026-07-21 19:03
VLAI
EPSS
VEX
Title
Data::SortedSet::Shared versions before 0.03 for Perl allow an out-of-bounds read via unvalidated node indices in the rank and min/max query paths
Summary
Data::SortedSet::Shared versions before 0.03 for Perl allow an out-of-bounds read via unvalidated node indices in the rank and min/max query paths.
The attach-time validator ss_validate_header bounds only the root index against the node pool (node_capacity). The order-statistics and min/max queries then follow children[], leftmost and rightmost node indices read raw from the mmap'd segment without bounding them against node_capacity. A full structural check (ss_validate_tree) exists but runs only via an explicit validate method, not on attach.
A local peer that can write the backing file can leave the header valid while poisoning the tree links, so the next rank, min or max query dereferences an out-of-bounds node index, reading adjacent memory or crashing the process.
Severity
No CVSS data available.
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| EGOR | Data::SortedSet::Shared |
Affected:
0 , < 0.03
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://cpan.org/modules",
"defaultStatus": "unaffected",
"packageName": "Data-SortedSet-Shared",
"product": "Data::SortedSet::Shared",
"programFiles": [
"sortedset.h"
],
"programRoutines": [
{
"name": "ss_rank_of"
},
{
"name": "ss_pop_locked"
}
],
"repo": "https://github.com/vividsnow/perl5-data-sortedset-shared",
"vendor": "EGOR",
"versions": [
{
"lessThan": "0.03",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Data::SortedSet::Shared versions before 0.03 for Perl allow an out-of-bounds read via unvalidated node indices in the rank and min/max query paths.\n\nThe attach-time validator ss_validate_header bounds only the root index against the node pool (node_capacity). The order-statistics and min/max queries then follow children[], leftmost and rightmost node indices read raw from the mmap\u0027d segment without bounding them against node_capacity. A full structural check (ss_validate_tree) exists but runs only via an explicit validate method, not on attach.\n\nA local peer that can write the backing file can leave the header valid while poisoning the tree links, so the next rank, min or max query dereferences an out-of-bounds node index, reading adjacent memory or crashing the process."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-21T19:03:16.345Z",
"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"shortName": "CPANSec"
},
"references": [
{
"url": "https://metacpan.org/release/EGOR/Data-SortedSet-Shared-0.03/diff/EGOR/Data-SortedSet-Shared-0.02#sortedset.h"
},
{
"tags": [
"release-notes"
],
"url": "https://metacpan.org/release/EGOR/Data-SortedSet-Shared-0.03/changes"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to Data::SortedSet::Shared 0.03 or later, which bounds every node index against the node pool before dereferencing it."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Data::SortedSet::Shared versions before 0.03 for Perl allow an out-of-bounds read via unvalidated node indices in the rank and min/max query paths",
"workarounds": [
{
"lang": "en",
"value": "For deployments that cannot upgrade to 0.03, place the backing file in a directory writable only by the owning user, so a local peer cannot tamper with the tree the query paths traverse."
}
],
"x_generator": {
"engine": "cpansec-cna-tool 0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"assignerShortName": "CPANSec",
"cveId": "CVE-2026-59140",
"datePublished": "2026-07-21T19:03:16.345Z",
"dateReserved": "2026-07-02T16:24:17.912Z",
"dateUpdated": "2026-07-21T19:03:16.345Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-65062 (GCVE-0-2026-65062)
Vulnerability from cvelistv5 – Published: 2026-07-21 19:08 – Updated: 2026-07-21 19:08
VLAI
EPSS
VEX
Title
Data::SortedSet::Shared versions before 0.03 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW
Summary
Data::SortedSet::Shared versions before 0.03 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW.
The segment is created in sortedset.h with open(path, O_RDWR|O_CREAT, 0666). The mode is 0666, so under the default umask 022 the file is created mode 0644 (world-readable). O_NOFOLLOW is absent, so a symlink planted at the path is followed, and O_EXCL is absent, so the open silently uses a pre-planted file instead of failing.
A "Shared" segment naturally lives in a shared directory such as /tmp or /dev/shm, where any local user can read the IPC payloads stored in the world-readable segment, and a pre-planted file or symlink at the path lets a local attacker win a pre-creation race or redirect the open.
Severity
No CVSS data available.
CWE
Assigner
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| EGOR | Data::SortedSet::Shared |
Affected:
0 , < 0.03
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://cpan.org/modules",
"defaultStatus": "unaffected",
"packageName": "Data-SortedSet-Shared",
"product": "Data::SortedSet::Shared",
"programFiles": [
"sortedset.h"
],
"repo": "https://github.com/vividsnow/perl5-data-sortedset-shared",
"vendor": "EGOR",
"versions": [
{
"lessThan": "0.03",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Data::SortedSet::Shared versions before 0.03 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW.\n\nThe segment is created in sortedset.h with open(path, O_RDWR|O_CREAT, 0666). The mode is 0666, so under the default umask 022 the file is created mode 0644 (world-readable). O_NOFOLLOW is absent, so a symlink planted at the path is followed, and O_EXCL is absent, so the open silently uses a pre-planted file instead of failing.\n\nA \"Shared\" segment naturally lives in a shared directory such as /tmp or /dev/shm, where any local user can read the IPC payloads stored in the world-readable segment, and a pre-planted file or symlink at the path lets a local attacker win a pre-creation race or redirect the open."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-732",
"description": "CWE-732 Incorrect Permission Assignment for Critical Resource",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-59",
"description": "CWE-59 Improper Link Resolution Before File Access",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-21T19:08:01.856Z",
"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"shortName": "CPANSec"
},
"references": [
{
"url": "https://metacpan.org/release/EGOR/Data-SortedSet-Shared-0.03/diff/EGOR/Data-SortedSet-Shared-0.02#sortedset.h"
},
{
"tags": [
"release-notes"
],
"url": "https://metacpan.org/release/EGOR/Data-SortedSet-Shared-0.03/changes"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to Data::SortedSet::Shared 0.03 or later, which creates the backing file mode 0600 (owner-only) with O_EXCL and O_NOFOLLOW."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Data::SortedSet::Shared versions before 0.03 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW",
"workarounds": [
{
"lang": "en",
"value": "For deployments that cannot upgrade to 0.03, set a restrictive umask so the backing file is not world-readable and place it in a directory only the owning user can access."
}
],
"x_generator": {
"engine": "cpansec-cna-tool 0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"assignerShortName": "CPANSec",
"cveId": "CVE-2026-65062",
"datePublished": "2026-07-21T19:08:01.856Z",
"dateReserved": "2026-07-21T15:29:37.116Z",
"dateUpdated": "2026-07-21T19:08:01.856Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59140 (GCVE-0-2026-59140)
Vulnerability from cvelistv5 – Published: 2026-07-21 19:03 – Updated: 2026-07-21 19:03
VLAI
EPSS
VEX
Title
Data::SortedSet::Shared versions before 0.03 for Perl allow an out-of-bounds read via unvalidated node indices in the rank and min/max query paths
Summary
Data::SortedSet::Shared versions before 0.03 for Perl allow an out-of-bounds read via unvalidated node indices in the rank and min/max query paths.
The attach-time validator ss_validate_header bounds only the root index against the node pool (node_capacity). The order-statistics and min/max queries then follow children[], leftmost and rightmost node indices read raw from the mmap'd segment without bounding them against node_capacity. A full structural check (ss_validate_tree) exists but runs only via an explicit validate method, not on attach.
A local peer that can write the backing file can leave the header valid while poisoning the tree links, so the next rank, min or max query dereferences an out-of-bounds node index, reading adjacent memory or crashing the process.
Severity
No CVSS data available.
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| EGOR | Data::SortedSet::Shared |
Affected:
0 , < 0.03
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://cpan.org/modules",
"defaultStatus": "unaffected",
"packageName": "Data-SortedSet-Shared",
"product": "Data::SortedSet::Shared",
"programFiles": [
"sortedset.h"
],
"programRoutines": [
{
"name": "ss_rank_of"
},
{
"name": "ss_pop_locked"
}
],
"repo": "https://github.com/vividsnow/perl5-data-sortedset-shared",
"vendor": "EGOR",
"versions": [
{
"lessThan": "0.03",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Data::SortedSet::Shared versions before 0.03 for Perl allow an out-of-bounds read via unvalidated node indices in the rank and min/max query paths.\n\nThe attach-time validator ss_validate_header bounds only the root index against the node pool (node_capacity). The order-statistics and min/max queries then follow children[], leftmost and rightmost node indices read raw from the mmap\u0027d segment without bounding them against node_capacity. A full structural check (ss_validate_tree) exists but runs only via an explicit validate method, not on attach.\n\nA local peer that can write the backing file can leave the header valid while poisoning the tree links, so the next rank, min or max query dereferences an out-of-bounds node index, reading adjacent memory or crashing the process."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-21T19:03:16.345Z",
"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"shortName": "CPANSec"
},
"references": [
{
"url": "https://metacpan.org/release/EGOR/Data-SortedSet-Shared-0.03/diff/EGOR/Data-SortedSet-Shared-0.02#sortedset.h"
},
{
"tags": [
"release-notes"
],
"url": "https://metacpan.org/release/EGOR/Data-SortedSet-Shared-0.03/changes"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to Data::SortedSet::Shared 0.03 or later, which bounds every node index against the node pool before dereferencing it."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Data::SortedSet::Shared versions before 0.03 for Perl allow an out-of-bounds read via unvalidated node indices in the rank and min/max query paths",
"workarounds": [
{
"lang": "en",
"value": "For deployments that cannot upgrade to 0.03, place the backing file in a directory writable only by the owning user, so a local peer cannot tamper with the tree the query paths traverse."
}
],
"x_generator": {
"engine": "cpansec-cna-tool 0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"assignerShortName": "CPANSec",
"cveId": "CVE-2026-59140",
"datePublished": "2026-07-21T19:03:16.345Z",
"dateReserved": "2026-07-02T16:24:17.912Z",
"dateUpdated": "2026-07-21T19:03:16.345Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}