Data::ReqRep::Shared versions before 0.05 for Perl allow an out-of-bounds read via an unvalidated arena offset and length in reqreprecvlocked.

The attach-time validator reqrepvalidateheader checks the header scalars and region layout against the file size, but does not validate the array contents it then trusts. reqreprecvlocked does memcpy(copybuf, reqarena + arenaoff, len) with arenaoff and len read raw from the mmap'd segment and never bounded against the arena capacity (reqarenacap).

A local peer that can write the backing file can leave the header valid while poisoning a request slot's offset and length, so receiving the request copies a file-controlled offset and length out of the arena, reading adjacent memory or crashing the process.

Race condition in the rmtree function in File::Path 1.08 and 2.07 (lib/File/Path.pm) in Perl 5.8.8 and 5.10.0 allows local users to create arbitrary setuid binaries via a symlink attack, a different vulnerability than CVE-2005-0448, CVE-2004-0452, and CVE-2008-2827. NOTE: this is a regression error related to CVE-2005-0448. It is different from CVE-2008-5303 due to affected versions.

Race condition in the rmtree function in File::Path 1.08 (lib/File/Path.pm) in Perl 5.8.8 allows local users to to delete arbitrary files via a symlink attack, a different vulnerability than CVE-2005-0448, CVE-2004-0452, and CVE-2008-2827. NOTE: this is a regression error related to CVE-2005-0448. It is different from CVE-2008-5302 due to affected versions.

Robots::Validate versions from 0.3.2 before 0.3.11 for Perl allow unbounded outbound DNS queries per validation via a forward-confirmation loop that does not bound the names it queries.

checkdns issues one PTR query for the client address, keeps the returned names matching the rule's domain, and issues a forward query for each until one resolves back to that address. Nothing bounds that list, and a client controls the reverse zone for its own address, so it chooses how many names the PTR answer holds. Net::DNS refetches a truncated answer over TCP by default, so the 512-byte UDP payload does not cap it either.

Any client whose User-Agent matches a rule with a domain reaches checkdns. Each forward name is distinct and client-chosen, so every query misses the local cache and is resolved against the authoritative servers for that domain. The queries are synchronous, so the caller is held until all of them answer or time out.

Data::Intern::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without OEXCL or ONOFOLLOW.

The segment is created in intern.h with open(path, ORDWR|OCREAT, 0666). The mode is 0666, so under the default umask 022 the file is created mode 0644 (world-readable). ONOFOLLOW is absent, so a symlink planted at the path is followed, and OEXCL is absent, so the open silently uses a pre-planted file instead of failing.

A "Shared" segment naturally lives in a shared directory such as /tmp or /dev/shm, where any local user can read the IPC payloads stored in the world-readable segment, and a pre-planted file or symlink at the path lets a local attacker win a pre-creation race or redirect the open.

======================================================================== CVE-2026-57074                                       CPAN Security Group ========================================================================

CVE ID:  CVE-2026-57074   Distribution:  XML-Bare       Versions:  through 0.53

MetaCPAN:  https://metacpan.org/dist/XML-Bare       VCS Repo:  https://github.com/nanoscopic/perl-XML-Bare

XML::Bare versions through 0.53 for Perl have an unbounded character lookahead

Description ----------- XML::Bare versions through 0.53 for Perl have an unbounded character lookahead.

The parsercparse function attempts to check for multicharacter strings such as "<![CDATA" or element terminators such as ">" without checking that the offsets are within the buffer.

Truncated strings such as "<a/" can trigger an out-of-bounds read.

Problem types ------------- - CWE-125 Out-of-bounds Read

Workarounds ----------- Apply the patch.

References ---------- https://github.com/nanoscopic/perl-XML-Bare/pull/1 https://security.metacpan.org/patches/X/XML-Bare/0.53/CVE-2026-57074-r1.patch