# CVE-2026-59139: EGOR Data::ReqRep::Shared out-of-bounds read in reqrep_recv_locked

Source: https://junglewise.ai/threats/cve-2026-59139-egor-data-reqrep-shared-out-of-bounds-read-in-reqrep-recv-locked  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-21. Updated: 2026-07-21  
License: CC BY 4.0 with a link back

CVE-2026-59139 · Severity: info · Published 2026-07-21

Data::ReqRep::Shared is a Perl library used for shared memory communication between processes. A security flaw allows a local attacker with access to the library's backing file to trigger an out-of-bounds memory read. This could lead to the exposure of sensitive information from the application's memory or cause the application to crash, resulting in a denial of service.

Vendors: [EGOR Data](https://junglewise.ai/threats/vendors/egor-data).

## Quick answers

**Is CVE-2026-59139 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-59139 being exploited in the wild.

**How severe is CVE-2026-59139?** Informational severity, published 21 July 2026.

**Which products and versions are affected?** EGOR Data ReqRep::Shared before 0.05.

**Is there a fix for CVE-2026-59139?** A patch was published on 2026-07-21: Fixed in version 0.05 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-59139 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-59139?** Check whether you run EGOR Data ReqRep::Shared at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An out-of-bounds read vulnerability exists in Data::ReqRep::Shared before version 0.05 due to insufficient validation of memory offsets. The function reqrep_recv_locked performs a memcpy using an offset and length read directly from a memory-mapped (mmap'd) segment without verifying them against the actual arena capacity (req_arena_cap). A local attacker who can modify the backing file can poison these values while maintaining a valid header. When the process attempts to receive the request, it may read adjacent memory or crash. This issue is addressed in version 0.05.

## Affected products

- EGOR Data::ReqRep::Shared before 0.05

## Timeline

- 2026-07-21: advisory
- 2026-07-21: disclosed
- 2026-07-21: patched: Fixed in version 0.05

## References

- [https://cpan.org/modules](https://cpan.org/modules)
- [https://metacpan.org/release/EGOR/Data-ReqRep-Shared-0.05/changes](https://metacpan.org/release/EGOR/Data-ReqRep-Shared-0.05/changes)
- [https://metacpan.org/release/EGOR/Data-ReqRep-Shared-0.05/diff/EGOR/Data-ReqRep-Shared-0.04](https://metacpan.org/release/EGOR/Data-ReqRep-Shared-0.05/diff/EGOR/Data-ReqRep-Shared-0.04)

## Related threats

- [Data::ReqRep::Shared insecure file permissions and symlink following](https://junglewise.ai/threats/cve-2026-65061-data-reqrep-shared-insecure-file-permissions-and-symlink)