CVE-2026-59147
A critical flaw in the Perl module Data::DisjointSet::Shared (versions before 0.02) allows attackers to read and write memory outside the intended bounds. The vulnerability arises from an unvalidated parent index used during set operations, which can corrupt memory or crash the program. It affects any Perl application that loads this module and writes to its backing file.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Perl developers using Data::DisjointSet::Shared versions earlier than 0.02, especially those that write to the module’s backing file.
Real-world impact
An attacker who can write to the module’s backing file can corrupt the program’s memory or cause it to crash, potentially leading to denial of service or arbitrary code execution if the crash is exploitable.
Why this severity
The CVSS score of 9.8 reflects that the vulnerability is exploitable over the network (AV:N), requires no authentication (PR:N), and has no user interaction (UI:N). It can compromise confidentiality, integrity, and availability (C:H/I:H/A:H) with low attack complexity (AC:L) and is not mitigated by any security controls (S:U).
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources