CVE-2026-65061

Data::ReqRep::Shared for Perl is affected in versions before 0.05. The issue arises because the code creates a world-readable mmap backing file by opening path with O_RDWR | O_CREAT and mode 0666 (leading to 0644 under umask) and does not use O_EXCL or O_NOFOLLOW, allowing a local user to read IP...

CVE-2026-64617 Data::PubSub::Shared versions before 0.07 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW

Data::PubSub::Shared versions before 0.07 for Perl create a world-readable mmap backing file and open it without OEXCL or ONOFOLLOW. The segment is created in pubsub.h with openpath, ORDWR|OCREAT, 0666. The mode is 0666, so under the default umask 022 the file is created mode 0644 world-readable...

CVE-2026-64616 Data::NDArray::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW

Data::NDArray::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without OEXCL or ONOFOLLOW. The segment is created in ndarray.h with openpath, ORDWR|OCREAT, 0666. The mode is 0666, so under the default umask 022 the file is created mode 0644 world-readabl...

CVE-2026-64616

CVE-2026-64616 affects Data::NDArray::Shared prior to version 0.02 for Perl. The code creates a mmap-backed segment by opening a path with open(path, O_RDWR|O_CREAT, 0666) and mode 0666, leading to a world-readable file (0644 after umask). With O_NOFOLLOW absent and O_EXCL absent, a symlink or pr...

CVE-2026-64615 Data::Graph::Shared versions before 0.04 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW

Data::Graph::Shared versions before 0.04 for Perl create a world-readable mmap backing file and open it without OEXCL or ONOFOLLOW. The segment is created in graph.h with openpath, ORDWR|OCREAT, 0666. The mode is 0666, so under the default umask 022 the file is created mode 0644 world-readable...

CVE-2026-64615

Data::Graph::Shared versions before 0.04 for Perl create a world-readable mmap backing file and open it without OEXCL or ONOFOLLOW. The segment is created in graph.h with openpath, ORDWR|OCREAT, 0666. The mode is 0666, so under the default umask 022 the file is created mode 0644 world-readable...

CVE-2026-64615

CVE-2026-64615 affects Data::Graph::Shared for Perl, specifically versions before 0.04. The implementation creates a world-readable mmap backing file by opening path with O_RDWR|O_CREAT and mode 0666 (leading to 0644 under default umask), without O_NOFOLLOW or O_EXCL checks. This enables local us...

CVE-2026-64614 Data::Deque::Shared versions before 0.06 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW

Data::Deque::Shared versions before 0.06 for Perl create a world-readable mmap backing file and open it without OEXCL or ONOFOLLOW. The segment is created in deque.h with openpath, ORDWR|OCREAT, 0666. The mode is 0666, so under the default umask 022 the file is created mode 0644 world-readable...

CVE-2026-64613

Data::Buffer::Shared for Perl versions before 0.05 is affected. A world-readable mmap backing file is created (mode 0666 then 0644 by default umask) and opened with open(path, O_RDWR|O_CREAT|O_EXCL) without O_NOFOLLOW. A pre-planted symlink at the path can be followed, allowing local users to rea...

CVE-2026-64613 Data::Buffer::Shared versions before 0.05 for Perl create a world-readable mmap backing file and open it without O_NOFOLLOW

Data::Buffer::Shared versions before 0.05 for Perl create a world-readable mmap backing file and open it without ONOFOLLOW. The segment is created in bufgeneric.h with openpath, ORDWR|OCREAT|OEXCL, 0666. OEXCL blocks a pre-seeded file on create, but the mode is 0666, so under the default umask 02...

CVE-2026-59147

CVE-2026-59147 – Data::DisjointSet::Shared (Perl) affects versions before 0.02. The root cause is an unvalidated, raw file-stored index used by dsu_find to walk and path‑compress parent[x], never bounded against the node count. The attach-time header validation validates header scalars but not th...

CVE-2026-59147 Data::DisjointSet::Shared versions before 0.02 for Perl allow out-of-bounds reads and writes via an unvalidated parent index in dsu_find

Data::DisjointSet::Shared versions before 0.02 for Perl allow out-of-bounds reads and writes via an unvalidated parent index in dsufind. The attach-time validator dsuvalidateheader checks the header scalars and region layout against the file size, but does not validate the array contents it then...

CVE-2026-59146 Data::SpatialHash::Shared versions before 0.02 for Perl allow out-of-bounds reads and writes via unvalidated bucket, link and free-list indices in sph_walk_cell and sph_alloc_slot

Data::SpatialHash::Shared versions before 0.02 for Perl allow out-of-bounds reads and writes via unvalidated bucket, link and free-list indices in sphwalkcell and sphallocslot. The attach-time validator sphvalidateheader checks the header scalars and region layout against the file size, but does...

CVE-2026-59145

Data::Intern::Shared before 0.02 for Perl is affected by an out-of-bounds read in si_idx_find due to unvalidated arrays after a seemingly thorough header validation. The code walks a triple indirection: arena[reverse[slots[i].id]] without bounds checks on slots[i].id against count, reverse offset...

CVE-2026-59145

Data::Intern::Shared versions before 0.02 for Perl allow an out-of-bounds read via unvalidated slot, reverse and arena indices in siidxfind. The attach-time validator sivalidateheader is thorough about the header and layout magic, version, section offsets, totalsize, count and arenaused but does...

CVE-2026-59145 Data::Intern::Shared versions before 0.02 for Perl allow an out-of-bounds read via unvalidated slot, reverse and arena indices in si_idx_find

Data::Intern::Shared versions before 0.02 for Perl allow an out-of-bounds read via unvalidated slot, reverse and arena indices in siidxfind. The attach-time validator sivalidateheader is thorough about the header and layout magic, version, section offsets, totalsize, count and arenaused but does...

CVE-2026-59144

Data::RingBuffer::Shared prior to v0.04 for Perl has a stack-buffer overflow: ring_read_seq copies elem_size bytes into an 8-byte destination without capping elem_size, allowing a file-writable header to cause overflow and stack corruption. The attach-time header validation does not cap elem_size...

CVE-2026-59144

Data::RingBuffer::Shared versions before 0.04 for Perl allow a stack buffer overflow via an unvalidated elemsize in ringreadseq. The attach-time validator ringvalidateheader checks the capacity-overflow and totalsize consistency of the header but never caps elemsize against the destination size...

CVE-2026-59143 Data::RoaringBitmap::Shared versions before 0.02 for Perl allow an out-of-bounds read via an unvalidated container offset and cardinality in rb_contains_locked

Data::RoaringBitmap::Shared versions before 0.02 for Perl allow an out-of-bounds read via an unvalidated container offset and cardinality in rbcontainslocked. The attach-time validator rbvalidateheader checks the header scalars and region layout against the file size, but does not validate the...

CVE-2026-59143

CVE-2026-59143 affects Data::RoaringBitmap::Shared before 0.02 for Perl. An out-of-bounds read arises in rb_contains_locked due to an unvalidated container offset and cardinality: the attach-time validator checks header and region layout against file size but does not validate bucket contents, an...