CVE-2026-59139: CWE-125 Out-of-bounds Read in EGOR Data::ReqRep::Shared
Data::ReqRep::Shared versions before 0.05 for Perl allow an out-of-bounds read via an unvalidated arena offset and length in reqrep_recv_locked. The attach-time validator reqrep_validate_header checks the header scalars and region layout against the file size, but does not validate the array contents it then trusts. reqrep_recv_locked does memcpy(copy_buf, req_arena + arena_off, len) with arena_off and len read raw from the mmap'd segment and never bounded against the arena capacity (req_arena_cap). A local peer that can write the backing file can leave the header valid while poisoning a request slot's offset and length, so receiving the request copies a file-controlled offset and length out of the arena, reading adjacent memory or crashing the process.
AI Analysis
Technical Summary
CVE-2026-59139 is an out-of-bounds read vulnerability in Data::ReqRep::Shared versions prior to 0.05. The reqrep_recv_locked function performs a memcpy operation using offset and length values read directly from a memory-mapped file segment without bounding these values against the arena capacity. Although the header is validated at attach-time, the array contents are not, allowing a local attacker with write access to the backing file to manipulate these values. This can lead to reading memory outside the intended buffer or crashing the process.
Potential Impact
An attacker with local write access to the backing file can cause the application to read memory beyond the allocated arena, potentially leaking sensitive information or causing a denial of service via process crash. There is no indication of remote exploitation or code execution from the provided data.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict local write access to the backing file to trusted users only to prevent exploitation.
CVE-2026-59139: CWE-125 Out-of-bounds Read in EGOR Data::ReqRep::Shared
Description
Data::ReqRep::Shared versions before 0.05 for Perl allow an out-of-bounds read via an unvalidated arena offset and length in reqrep_recv_locked. The attach-time validator reqrep_validate_header checks the header scalars and region layout against the file size, but does not validate the array contents it then trusts. reqrep_recv_locked does memcpy(copy_buf, req_arena + arena_off, len) with arena_off and len read raw from the mmap'd segment and never bounded against the arena capacity (req_arena_cap). A local peer that can write the backing file can leave the header valid while poisoning a request slot's offset and length, so receiving the request copies a file-controlled offset and length out of the arena, reading adjacent memory or crashing the process.
Affected software
pkg:github/Data-ReqRep-SharedRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-59139 is an out-of-bounds read vulnerability in Data::ReqRep::Shared versions prior to 0.05. The reqrep_recv_locked function performs a memcpy operation using offset and length values read directly from a memory-mapped file segment without bounding these values against the arena capacity. Although the header is validated at attach-time, the array contents are not, allowing a local attacker with write access to the backing file to manipulate these values. This can lead to reading memory outside the intended buffer or crashing the process.
Potential Impact
An attacker with local write access to the backing file can cause the application to read memory beyond the allocated arena, potentially leaking sensitive information or causing a denial of service via process crash. There is no indication of remote exploitation or code execution from the provided data.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict local write access to the backing file to trusted users only to prevent exploitation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- CPANSec
- Date Reserved
- 2026-07-02T16:24:17.912Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a5fc4922a4a8d5989a1c9f1
Added to database: 07/21/2026, 19:12:18 UTC
Last enriched: 07/21/2026, 19:27:05 UTC
Last updated: 07/21/2026, 21:10:09 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.