Is CVE-2026-65061 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-65061 being exploited in the wild.

How severe is CVE-2026-65061?

Informational severity, with a CVSS score of 0, published 21 July 2026.

Which products and versions are affected?

EGOR Data ReqRep::Shared before 0.05.

Is there a fix for CVE-2026-65061?

A patch was published on 2026-07-21: Version 0.05 released to address the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-65061 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-65061?

Check whether you run EGOR Data ReqRep::Shared at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-65061: Data::ReqRep::Shared insecure file permissions and symlink following

CVE-2026-65061 · Severity: info · CVSS 0 · Published 2026-07-21

Data::ReqRep::Shared is a Perl library used for sharing data between different processes on a computer. A security flaw allows local users to read sensitive information stored in these shared memory segments because the files are created with overly broad permissions. Additionally, an attacker could trick the software into writing data to the wrong location, potentially leading to data corruption or unauthorized access.

Vendors: EGOR Data.

Quick answers

Is CVE-2026-65061 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-65061 being exploited in the wild.
How severe is CVE-2026-65061?: Informational severity, with a CVSS score of 0, published 21 July 2026.
Which products and versions are affected?: EGOR Data ReqRep::Shared before 0.05.
Is there a fix for CVE-2026-65061?: A patch was published on 2026-07-21: Version 0.05 released to address the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-65061 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-65061?: Check whether you run EGOR Data ReqRep::Shared at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Data::ReqRep::Shared before version 0.05 suffers from insecure file handling in reqrep.h. The library creates mmap backing files using open() with the 0666 mode, which results in world-readable files (0644) under standard umask settings, allowing local users to read IPC payloads. Furthermore, the absence of O_NOFOLLOW and O_EXCL flags during the open() call makes the application vulnerable to symlink attacks and race conditions. A local attacker can pre-plant a file or symlink in shared directories like /tmp or /dev/shm to redirect file operations or capture data. The issue is resolved in version 0.05.

Affected products

EGOR Data::ReqRep::Shared before 0.05

Timeline

2026-07-21: advisory: CVE-2026-65061 published by NVD
2026-07-21: patched: Version 0.05 released to address the vulnerability

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.