CVE-2026-59141

Data::RadixTree::Shared versions before 0.02 for Perl allow an out-of-bounds read via unvalidated node and arena indices in rdxfindlocked. The attach-time validator rdxvalidateheader checks the header scalars and region layout against the file size, but does not validate the node records it then...

CVE-2026-65063

Data::RadixTree::Shared for Perl prior to 0.02 creates a world-readable mmap backing file via open(path, O_RDWR|O_CREAT, 0666). The file is created with mode 0666 so under umask 022 it is 0644 (world-readable). With O_NOFOLLOW missing and O_EXCL missing, a symlink or pre-created file at the path ...