========================================================================
CVE-2026-59140                                       CPAN Security Group
========================================================================

         CVE ID:  CVE-2026-59140
   Distribution:  Data-SortedSet-Shared
       Versions:  before 0.03

       MetaCPAN:  https://metacpan.org/dist/Data-SortedSet-Shared
       VCS Repo: https://github.com/vividsnow/perl5-data-sortedset-shared

Data::SortedSet::Shared versions before 0.03 for Perl allow an
out-of-bounds read via unvalidated node indices in the rank and min/max
query paths

Description
-----------
Data::SortedSet::Shared versions before 0.03 for Perl allow an
out-of-bounds read via unvalidated node indices in the rank and min/max
query paths.

The attach-time validator ss_validate_header bounds only the root index
against the node pool (node_capacity). The order-statistics and min/max
queries then follow children[], leftmost and rightmost node indices
read raw from the mmap'd segment without bounding them against
node_capacity. A full structural check (ss_validate_tree) exists but
runs only via an explicit validate method, not on attach.

A local peer that can write the backing file can leave the header valid
while poisoning the tree links, so the next rank, min or max query
dereferences an out-of-bounds node index, reading adjacent memory or
crashing the process.

Problem types
-------------
- CWE-125 Out-of-bounds Read

Workarounds
-----------
For deployments that cannot upgrade to 0.03, place the backing file in
a directory writable only by the owning user, so a local peer cannot
tamper with the tree the query paths traverse.

Solutions
---------
Upgrade to Data::SortedSet::Shared 0.03 or later, which bounds every
node index against the node pool before dereferencing it.

References
----------
https://metacpan.org/release/EGOR/Data-SortedSet-Shared-0.03/diff/EGOR/Data-SortedSet-Shared-0.02#sortedset.h
https://metacpan.org/release/EGOR/Data-SortedSet-Shared-0.03/changes