CVE-2026-59140
A critical flaw in the Perl Data::SortedSet::Shared module allows an attacker to read memory outside the intended bounds or crash the program. The issue arises from unvalidated node indices used in rank and min/max queries. It affects versions earlier than 0.03.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Perl developers using the Data::SortedSet::Shared module, versions before 0.03.
Real-world impact
An attacker who can write to the module’s backing file could cause the program to read sensitive data from adjacent memory or crash, potentially leading to information disclosure or denial of service.
Why this severity
The CVSS score of 9.1 reflects that the vulnerability is exploitable over the network with no authentication or user interaction, and it can lead to complete compromise of confidentiality and availability.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources