CVE-2026-59139: Data::ReqRep::Shared versions before 0.05 for Perl allow an out-of-bounds read via an unvalidated arena offset and length in reqrep_recv_locked

Data::ReqRep::Shared versions before 0.05 for Perl allow an out-of-bounds read via an unvalidated arena offset and length in reqreprecvlocked.

The attach-time validator reqrepvalidateheader checks the header scalars and region layout against the file size, but does not validate the array contents it then trusts. reqreprecvlocked does memcpy(copybuf, reqarena + arenaoff, len) with arenaoff and len read raw from the mmap'd segment and never bounded against the arena capacity (reqarenacap).

A local peer that can write the backing file can leave the header valid while poisoning a request slot's offset and length, so receiving the request copies a file-controlled offset and length out of the arena, reading adjacent memory or crashing the process.