CVE-2026-65066

Data::RingBuffer::Shared for Perl versions before 0.04 creates a world-readable mmap backing file via open(path, O_RDWR|O_CREAT, 0666) with mode 0644 after umask. The code uses O_NOFOLLOW absent and O_EXCL absent, so a symlink or pre-created file at the path can be followed or reused, enabling a ...

CVE-2026-65064

Data::HashMap::Shared before 0.14 for Perl creates a world-readable mmap backing file and opens it with 0666 permissions, without O_EXCL or O_NOFOLLOW. The file is opened with open(path, O_RDWR|O_CREAT|O_CLOEXEC, 0666) in shm_generic.h, yielding a world-readable 0644 file (umask 022). A pre-creat...

CVE-2026-64617

Data::PubSub::Shared before 0.07 (Perl) creates a world-readable mmap backing file via open(path, O_RDWR|O_CREAT, 0666) with mode 0644 after umask. Lack of O_NOFOLLOW and O_EXCL enables a local attacker to follow a symlink or race, potentially reading IPC payloads stored in the shared segment. Th...