The attach-time validator dsu_validate_header checks the header scalars and region layout against the file size, but does not validate the array contents it then trusts. dsu_find walks and path-compresses parent[x] with x a raw file-stored index never bounded against the node count, so both the read and the compression write-back land out of bounds.
A local peer that can write the backing file can leave the header valid while poisoning the parent array, so the next find or union both reads and writes through an out-of-bounds parent index, corrupting memory or crashing the process.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| EGOR | Data::DisjointSet::Shared | unaffected |
|
No data.
No data.
OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.
| Vendors | Products |
|---|---|
|
Egor
Subscribe
|
Data::disjointset::shared
Subscribe
|
No advisories yet.
Solution
Upgrade to Data::DisjointSet::Shared 0.02 or later, which bounds every parent index against the node count before using it.
Workaround
For deployments that cannot upgrade to 0.02, place the backing file in a directory writable only by the owning user, so a local peer cannot tamper with the parent array that find and union traverse.
Thu, 23 Jul 2026 21:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Egor
Egor data::disjointset::shared |
|
| Vendors & Products |
Egor
Egor data::disjointset::shared |
Thu, 23 Jul 2026 13:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
cvssV3_1
|
Tue, 21 Jul 2026 19:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Data::DisjointSet::Shared versions before 0.02 for Perl allow out-of-bounds reads and writes via an unvalidated parent index in dsu_find. The attach-time validator dsu_validate_header checks the header scalars and region layout against the file size, but does not validate the array contents it then trusts. dsu_find walks and path-compresses parent[x] with x a raw file-stored index never bounded against the node count, so both the read and the compression write-back land out of bounds. A local peer that can write the backing file can leave the header valid while poisoning the parent array, so the next find or union both reads and writes through an out-of-bounds parent index, corrupting memory or crashing the process. | |
| Title | Data::DisjointSet::Shared versions before 0.02 for Perl allow out-of-bounds reads and writes via an unvalidated parent index in dsu_find | |
| Weaknesses | CWE-125 CWE-787 |
|
| References |
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: CPANSec
Published:
Updated: 2026-07-23T12:17:04.895Z
Reserved: 2026-07-02T16:24:17.913Z
Link: CVE-2026-59147
Vulnrichment
Updated: 2026-07-23T12:16:54.436Z
NVD
No data.
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-07-24T03:15:02Z