========================================================================
CVE-2026-59139                                       CPAN Security Group
========================================================================

         CVE ID:  CVE-2026-59139
   Distribution:  Data-ReqRep-Shared
       Versions:  before 0.05

       MetaCPAN:  https://metacpan.org/dist/Data-ReqRep-Shared
       VCS Repo: https://github.com/vividsnow/perl5-data-reqrep-shared

Data::ReqRep::Shared versions before 0.05 for Perl allow an
out-of-bounds read via an unvalidated arena offset and length in
reqrep_recv_locked

Description
-----------
Data::ReqRep::Shared versions before 0.05 for Perl allow an
out-of-bounds read via an unvalidated arena offset and length in
reqrep_recv_locked.

The attach-time validator reqrep_validate_header checks the header
scalars and region layout against the file size, but does not validate
the array contents it then trusts. reqrep_recv_locked does
memcpy(copy_buf, req_arena + arena_off, len) with arena_off and len
read raw from the mmap'd segment and never bounded against the arena
capacity (req_arena_cap).

A local peer that can write the backing file can leave the header valid
while poisoning a request slot's offset and length, so receiving the
request copies a file-controlled offset and length out of the arena,
reading adjacent memory or crashing the process.

Problem types
-------------
- CWE-125 Out-of-bounds Read

Workarounds
-----------
For deployments that cannot upgrade to 0.05, place the backing file in
a directory writable only by the owning user, so a local peer cannot
tamper with the segment contents the read path trusts.

Solutions
---------
Upgrade to Data::ReqRep::Shared 0.05 or later, which bounds the arena
offset and length against the arena capacity before the copy.

References
----------
https://metacpan.org/release/EGOR/Data-ReqRep-Shared-0.05/diff/EGOR/Data-ReqRep-Shared-0.04#reqrep.h
https://metacpan.org/release/EGOR/Data-ReqRep-Shared-0.05/changes