CVE-2026-59139

Data::ReqRep::Shared versions before 0.05 for Perl allow an out-of-bounds read via an unvalidated arena offset and length in reqreprecvlocked. The attach-time validator reqrepvalidateheader checks the header scalars and region layout against the file size, but does not validate the array contents...

CVE-2026-65061

CVE-2026-65061 affects Data::ReqRep::Shared for Perl before version 0.05. It creates a mmap-backed IPC segment using open(path, O_RDWR|O_CREAT, 0666) in reqrep.h, with mode 0666 so the backing file is world-readable (0644 under umask 022). O_NOFOLLOW is not used and O_EXCL is absent, allowing a s...

CVE-2026-59139

Data::ReqRep::Shared (Perl) prior to 0.05 is affected by an out-of-bounds read. The vulnerability stems from reqrep_recv_locked, which copies data using arena_off and len read from an mmap’d segment without validating against the arena capacity (req_arena_cap). While the attach-time validator val...