Executive brief
Data::DisjointSet::Shared is a Perl library used for managing shared data structures across different processes. A security flaw in versions before 0.02 allows local users on the same system to read sensitive data stored in these shared memory segments. Additionally, a local attacker could trick the library into using a malicious file, potentially leading to data corruption or unauthorized access to information.
Technical details
The vulnerability stems from insecure file operations in dsu.h. Specifically, the library uses open() with mode 0666, which results in world-readable files (0644) under default umask settings. Furthermore, the absence of O_EXCL and O_NOFOLLOW flags allows a local attacker to perform symlink attacks or win a race condition by pre-planting a file in shared directories like /tmp or /dev/shm. This enables unauthorized reading of IPC payloads or redirection of the memory-mapped file to an attacker-controlled location. The issue is resolved in version 0.02, which implements mode 0600 by default.
Affected products
- EGOR Data::DisjointSet::Shared < 0.02
Timeline
- 2026-07-03: patched: Version 0.02 released with security hardening.
- 2026-07-21: disclosed: CVE-2026-65069 published.