CVE-2026-59139

Name of the Vulnerable Software and Affected Versions Data::ReqRep::Shared versions prior to 0.05

Description An out-of-bounds read exists due to unvalidated arena offset and length in the reqrep recv locked() function. While the reqrep validate header() function checks header scalars and region layout against file size, it fails to validate the array contents. Consequently, reqrep recv locked() performs a memcpy() operation using arena off and len values read directly from the mmap'd segment without bounding them against the arena capacity (req arena cap). A local peer with write access to the backing file can poison a request slot's offset and length, allowing the process to read adjacent memory or crash.

Recommendations Update to version 0.05 or later.