========================================================================
CVE-2026-59147                                       CPAN Security Group
========================================================================

         CVE ID:  CVE-2026-59147
   Distribution:  Data-DisjointSet-Shared
       Versions:  before 0.02

       MetaCPAN:  https://metacpan.org/dist/Data-DisjointSet-Shared
       VCS Repo: https://github.com/vividsnow/perl5-data-disjointset-shared

Data::DisjointSet::Shared versions before 0.02 for Perl allow
out-of-bounds reads and writes via an unvalidated parent index in
dsu_find

Description
-----------
Data::DisjointSet::Shared versions before 0.02 for Perl allow
out-of-bounds reads and writes via an unvalidated parent index in
dsu_find.

The attach-time validator dsu_validate_header checks the header scalars
and region layout against the file size, but does not validate the
array contents it then trusts. dsu_find walks and path-compresses
parent[x] with x a raw file-stored index never bounded against the node
count, so both the read and the compression write-back land out of
bounds.

A local peer that can write the backing file can leave the header valid
while poisoning the parent array, so the next find or union both reads
and writes through an out-of-bounds parent index, corrupting memory or
crashing the process.

Problem types
-------------
- CWE-787 Out-of-bounds Write
- CWE-125 Out-of-bounds Read

Workarounds
-----------
For deployments that cannot upgrade to 0.02, place the backing file in
a directory writable only by the owning user, so a local peer cannot
tamper with the parent array that find and union traverse.

Solutions
---------
Upgrade to Data::DisjointSet::Shared 0.02 or later, which bounds every
parent index against the node count before using it.

References
----------
https://metacpan.org/release/EGOR/Data-DisjointSet-Shared-0.02/diff/EGOR/Data-DisjointSet-Shared-0.01#dsu.h
https://metacpan.org/release/EGOR/Data-DisjointSet-Shared-0.02/changes