Vulnerability-Lookup

RHSA-2026:62667

Vulnerability from csaf_opensuse - Published: 2026-09-02 15:09 - Updated: 2026-11-05 15:57

Summary

Red Hat Security Advisory: perl-DBI security update

Severity

Important

Notes

Topic: An update for perl-DBI is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: DBI is a database access Application Programming Interface (API) for the Perl Language. The DBI API Specification defines a set of functions, variables and conventions that provide a consistent database interface independent of the actual database being used. Security Fix(es): * perl-DBI: perl-DBI: Heap overflow in SQL preparsing can lead to denial of service or arbitrary code execution. (CVE-2026-10879) * DBI: DBI: Buffer overflow in error handling can lead to arbitrary code execution (CVE-2026-9698) * DBI: DBI: Arbitrary code execution via caller-influenced Profile attribute (CVE-2026-14380) * DBI: DBI: Heap overflow when preparsing SQL statements with excessive placeholders (CVE-2026-14739) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-9698

A flaw was found in DBI, a Perl database interface. This vulnerability allows an attacker to trigger a buffer overflow by manipulating error messages within an application. When specific error handling options are active, an attacker can provide oversized error text, which may lead to arbitrary code execution or a denial of service (DoS).

8.2 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

CWE-120 - Buffer Copy without Checking Size of Input

Affected products

Fixed 10 products

Product	Version	Remediation
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-0:1.641-2.el8_10.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-0:1.641-2.el8_10.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-0:1.641-2.el8_10.src	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-0:1.641-2.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debuginfo-0:1.641-2.el8_10.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debuginfo-0:1.641-2.el8_10.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debuginfo-0:1.641-2.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debugsource-0:1.641-2.el8_10.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debugsource-0:1.641-2.el8_10.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debugsource-0:1.641-2.el8_10.x86_64	—	Vendor Fix fix Workaround

Threats

Impact Important

CVE-2026-10879

A flaw was found in perl-DBI. A heap overflow vulnerability exists when preparsing SQL statements with more than 9 binders. The `preparse` method incorrectly allocates buffer space for SQL placeholder characters, leading to an overflow when processing binders with two or more digits. This can result in a denial of service or potentially arbitrary code execution.

7.7 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

CWE-131 - Incorrect Calculation of Buffer Size

Affected products

Fixed 10 products, the same list as for CVE-2026-9698

Threats

Impact Important

CVE-2026-14380

A flaw was found in the DBI component for Perl. This vulnerability allows an attacker to inject and execute arbitrary code by manipulating the Profile attribute of a DBI handle. When a string is assigned to this attribute, the component processes it without proper validation, enabling the execution of unauthorized Perl code, including system commands. An attacker with control over certain inputs, such as environment variables or connection string parameters, could exploit this to achieve arbitrary code execution on the affected system. In some configurations, this could lead to remote code execution.

8.8 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-94 - Improper Control of Generation of Code

Affected products

Fixed 10 products, the same list as for CVE-2026-9698

Threats

Impact Important

CVE-2026-14739

A flaw was found in DBI for Perl. This vulnerability, a heap overflow, occurs when the software attempts to preparse SQL statements containing an extremely large number of placeholders. This could allow a remote attacker to cause a denial of service or potentially execute arbitrary code.

8.1 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-131 - Incorrect Calculation of Buffer Size

Affected products

Fixed 10 products, the same list as for CVE-2026-9698

Threats

Impact Important

References

30 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:62667	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=2485464	external
https://bugzilla.redhat.com/show_bug.cgi?id=2486734	external
https://bugzilla.redhat.com/show_bug.cgi?id=2497915	external
https://bugzilla.redhat.com/show_bug.cgi?id=2497916	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-9698	self
https://bugzilla.redhat.com/show_bug.cgi?id=2486734	external
https://www.cve.org/CVERecord?id=CVE-2026-9698	external
https://nvd.nist.gov/vuln/detail/CVE-2026-9698	external
https://github.com/perl5-dbi/dbi/commit/bfe5d73c1…	external
https://metacpan.org/release/HMBRAND/DBI-1.648/changes	external
https://access.redhat.com/security/cve/CVE-2026-10879	self
https://bugzilla.redhat.com/show_bug.cgi?id=2485464	external
https://www.cve.org/CVERecord?id=CVE-2026-10879	external
https://nvd.nist.gov/vuln/detail/CVE-2026-10879	external
https://github.com/perl5-dbi/dbi/commit/af79036c0…	external
https://access.redhat.com/security/cve/CVE-2026-14380	self
https://bugzilla.redhat.com/show_bug.cgi?id=2497915	external
https://www.cve.org/CVERecord?id=CVE-2026-14380	external
https://nvd.nist.gov/vuln/detail/CVE-2026-14380	external
https://github.com/perl5-dbi/dbi/commit/b73d5d990…	external
https://github.com/perl5-dbi/dbi/security/advisor…	external
https://metacpan.org/release/HMBRAND/DBI-1.650/changes	external
https://access.redhat.com/security/cve/CVE-2026-14739	self
https://bugzilla.redhat.com/show_bug.cgi?id=2497916	external
https://www.cve.org/CVERecord?id=CVE-2026-14739	external
https://nvd.nist.gov/vuln/detail/CVE-2026-14739	external
https://github.com/perl5-dbi/dbi/commit/2b77c88b6…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for perl-DBI is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "DBI is a database access Application Programming Interface (API) for the Perl Language. The DBI API Specification defines a set of functions, variables and conventions that provide a consistent database interface independent of the actual database being used.\n\nSecurity Fix(es):\n\n* perl-DBI: perl-DBI: Heap overflow in SQL preparsing can lead to denial of service or arbitrary code execution. (CVE-2026-10879)\n\n* DBI: DBI: Buffer overflow in error handling can lead to arbitrary code execution (CVE-2026-9698)\n\n* DBI: DBI: Arbitrary code execution via caller-influenced Profile attribute (CVE-2026-14380)\n\n* DBI: DBI: Heap overflow when preparsing SQL statements with excessive placeholders (CVE-2026-14739)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:62667",
        "url": "https://access.redhat.com/errata/RHSA-2026:62667"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2485464",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2485464"
      },
      {
        "category": "external",
        "summary": "2486734",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486734"
      },
      {
        "category": "external",
        "summary": "2497915",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497915"
      },
      {
        "category": "external",
        "summary": "2497916",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497916"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_62667.json"
      }
    ],
    "title": "Red Hat Security Advisory: perl-DBI security update",
    "tracking": {
      "current_release_date": "2026-11-05T15:57:14+00:00",
      "generator": {
        "date": "2026-11-05T15:57:14+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.4"
        }
      },
      "id": "RHSA-2026:62667",
      "initial_release_date": "2026-09-02T15:09:54+00:00",
      "revision_history": [
        {
          "date": "2026-09-02T15:09:54+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-09-02T15:09:54+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-11-05T15:57:14+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux BaseOS (v. 8)",
                "product": {
                  "name": "Red Hat Enterprise Linux BaseOS (v. 8)",
                  "product_id": "BaseOS-8.10.0.Z.MAIN.EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:8::baseos"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "perl-DBI-0:1.641-2.el8_10.src",
                "product": {
                  "name": "perl-DBI-0:1.641-2.el8_10.src",
                  "product_id": "perl-DBI-0:1.641-2.el8_10.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/perl-DBI@1.641-2.el8_10?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "perl-DBI-0:1.641-2.el8_10.aarch64",
                "product": {
                  "name": "perl-DBI-0:1.641-2.el8_10.aarch64",
                  "product_id": "perl-DBI-0:1.641-2.el8_10.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/perl-DBI@1.641-2.el8_10?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "perl-DBI-debugsource-0:1.641-2.el8_10.aarch64",
                "product": {
                  "name": "perl-DBI-debugsource-0:1.641-2.el8_10.aarch64",
                  "product_id": "perl-DBI-debugsource-0:1.641-2.el8_10.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/perl-DBI-debugsource@1.641-2.el8_10?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "perl-DBI-debuginfo-0:1.641-2.el8_10.aarch64",
                "product": {
                  "name": "perl-DBI-debuginfo-0:1.641-2.el8_10.aarch64",
                  "product_id": "perl-DBI-debuginfo-0:1.641-2.el8_10.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/perl-DBI-debuginfo@1.641-2.el8_10?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "perl-DBI-0:1.641-2.el8_10.ppc64le",
                "product": {
                  "name": "perl-DBI-0:1.641-2.el8_10.ppc64le",
                  "product_id": "perl-DBI-0:1.641-2.el8_10.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/perl-DBI@1.641-2.el8_10?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "perl-DBI-debugsource-0:1.641-2.el8_10.ppc64le",
                "product": {
                  "name": "perl-DBI-debugsource-0:1.641-2.el8_10.ppc64le",
                  "product_id": "perl-DBI-debugsource-0:1.641-2.el8_10.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/perl-DBI-debugsource@1.641-2.el8_10?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "perl-DBI-debuginfo-0:1.641-2.el8_10.ppc64le",
                "product": {
                  "name": "perl-DBI-debuginfo-0:1.641-2.el8_10.ppc64le",
                  "product_id": "perl-DBI-debuginfo-0:1.641-2.el8_10.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/perl-DBI-debuginfo@1.641-2.el8_10?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "perl-DBI-0:1.641-2.el8_10.x86_64",
                "product": {
                  "name": "perl-DBI-0:1.641-2.el8_10.x86_64",
                  "product_id": "perl-DBI-0:1.641-2.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/perl-DBI@1.641-2.el8_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "perl-DBI-debugsource-0:1.641-2.el8_10.x86_64",
                "product": {
                  "name": "perl-DBI-debugsource-0:1.641-2.el8_10.x86_64",
                  "product_id": "perl-DBI-debugsource-0:1.641-2.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/perl-DBI-debugsource@1.641-2.el8_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "perl-DBI-debuginfo-0:1.641-2.el8_10.x86_64",
                "product": {
                  "name": "perl-DBI-debuginfo-0:1.641-2.el8_10.x86_64",
                  "product_id": "perl-DBI-debuginfo-0:1.641-2.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/perl-DBI-debuginfo@1.641-2.el8_10?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "perl-DBI-0:1.641-2.el8_10.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-0:1.641-2.el8_10.aarch64"
        },
        "product_reference": "perl-DBI-0:1.641-2.el8_10.aarch64",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "perl-DBI-0:1.641-2.el8_10.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-0:1.641-2.el8_10.ppc64le"
        },
        "product_reference": "perl-DBI-0:1.641-2.el8_10.ppc64le",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "perl-DBI-0:1.641-2.el8_10.src as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-0:1.641-2.el8_10.src"
        },
        "product_reference": "perl-DBI-0:1.641-2.el8_10.src",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "perl-DBI-0:1.641-2.el8_10.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-0:1.641-2.el8_10.x86_64"
        },
        "product_reference": "perl-DBI-0:1.641-2.el8_10.x86_64",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "perl-DBI-debuginfo-0:1.641-2.el8_10.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debuginfo-0:1.641-2.el8_10.aarch64"
        },
        "product_reference": "perl-DBI-debuginfo-0:1.641-2.el8_10.aarch64",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "perl-DBI-debuginfo-0:1.641-2.el8_10.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debuginfo-0:1.641-2.el8_10.ppc64le"
        },
        "product_reference": "perl-DBI-debuginfo-0:1.641-2.el8_10.ppc64le",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "perl-DBI-debuginfo-0:1.641-2.el8_10.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debuginfo-0:1.641-2.el8_10.x86_64"
        },
        "product_reference": "perl-DBI-debuginfo-0:1.641-2.el8_10.x86_64",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "perl-DBI-debugsource-0:1.641-2.el8_10.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debugsource-0:1.641-2.el8_10.aarch64"
        },
        "product_reference": "perl-DBI-debugsource-0:1.641-2.el8_10.aarch64",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "perl-DBI-debugsource-0:1.641-2.el8_10.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debugsource-0:1.641-2.el8_10.ppc64le"
        },
        "product_reference": "perl-DBI-debugsource-0:1.641-2.el8_10.ppc64le",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "perl-DBI-debugsource-0:1.641-2.el8_10.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debugsource-0:1.641-2.el8_10.x86_64"
        },
        "product_reference": "perl-DBI-debugsource-0:1.641-2.el8_10.x86_64",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-9698",
      "cwe": {
        "id": "CWE-120",
        "name": "Buffer Copy without Checking Size of Input"
      },
      "discovery_date": "2026-06-09T08:00:53.401960+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2486734"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in DBI, a Perl database interface. This vulnerability allows an attacker to trigger a buffer overflow by manipulating error messages within an application. When specific error handling options are active, an attacker can provide oversized error text, which may lead to arbitrary code execution or a denial of service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "DBI: DBI: Buffer overflow in error handling can lead to arbitrary code execution",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Exploitation of this vulnerability requires that an attacker can provide values to an endpoint using perl-DBI which trigger certain errors. The attacker has no means of directly controlling the location and thus consequences of the buffer overflow, making the most likely outcome a denial-of-service due to corruption of the application\u0027s memory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-0:1.641-2.el8_10.aarch64",
          "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-0:1.641-2.el8_10.ppc64le",
          "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-0:1.641-2.el8_10.src",
          "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-0:1.641-2.el8_10.x86_64",
          "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debuginfo-0:1.641-2.el8_10.aarch64",
          "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debuginfo-0:1.641-2.el8_10.ppc64le",
          "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debuginfo-0:1.641-2.el8_10.x86_64",
          "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debugsource-0:1.641-2.el8_10.aarch64",
          "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debugsource-0:1.641-2.el8_10.ppc64le",
          "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debugsource-0:1.641-2.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-9698"
        },
        {
          "category": "external",
          "summary": "RHBZ#2486734",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486734"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-9698",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-9698"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-9698",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9698"
        },
        {
          "category": "external",
          "summary": "https://github.com/perl5-dbi/dbi/commit/bfe5d73c162d2d1f761a639a0aa33aad6a9eb54e.patch",
          "url": "https://github.com/perl5-dbi/dbi/commit/bfe5d73c162d2d1f761a639a0aa33aad6a9eb54e.patch"
        },
        {
          "category": "external",
          "summary": "https://metacpan.org/release/HMBRAND/DBI-1.648/changes",
          "url": "https://metacpan.org/release/HMBRAND/DBI-1.648/changes"
        }
      ],
      "release_date": "2026-06-09T07:22:25.892000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-02T15:09:54+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-0:1.641-2.el8_10.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-0:1.641-2.el8_10.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-0:1.641-2.el8_10.src",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-0:1.641-2.el8_10.x86_64",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debuginfo-0:1.641-2.el8_10.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debuginfo-0:1.641-2.el8_10.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debuginfo-0:1.641-2.el8_10.x86_64",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debugsource-0:1.641-2.el8_10.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debugsource-0:1.641-2.el8_10.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debugsource-0:1.641-2.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:62667"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Users are advised to identify network-accessible applications which use perl-DBI and ensure that only trusted users have access to those applications.",
          "product_ids": [
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-0:1.641-2.el8_10.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-0:1.641-2.el8_10.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-0:1.641-2.el8_10.src",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-0:1.641-2.el8_10.x86_64",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debuginfo-0:1.641-2.el8_10.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debuginfo-0:1.641-2.el8_10.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debuginfo-0:1.641-2.el8_10.x86_64",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debugsource-0:1.641-2.el8_10.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debugsource-0:1.641-2.el8_10.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debugsource-0:1.641-2.el8_10.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-0:1.641-2.el8_10.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-0:1.641-2.el8_10.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-0:1.641-2.el8_10.src",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-0:1.641-2.el8_10.x86_64",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debuginfo-0:1.641-2.el8_10.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debuginfo-0:1.641-2.el8_10.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debuginfo-0:1.641-2.el8_10.x86_64",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debugsource-0:1.641-2.el8_10.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debugsource-0:1.641-2.el8_10.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debugsource-0:1.641-2.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "DBI: DBI: Buffer overflow in error handling can lead to arbitrary code execution"
    },
    {
      "cve": "CVE-2026-10879",
      "cwe": {
        "id": "CWE-131",
        "name": "Incorrect Calculation of Buffer Size"
      },
      "discovery_date": "2026-06-05T15:01:03.077249+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2485464"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in perl-DBI. A heap overflow vulnerability exists when preparsing SQL statements with more than 9 binders. The `preparse` method incorrectly allocates buffer space for SQL placeholder characters, leading to an overflow when processing binders with two or more digits. This can result in a denial of service or potentially arbitrary code execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "perl-DBI: perl-DBI: Heap overflow in SQL preparsing can lead to denial of service or arbitrary code execution.",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A heap buffer overflow flaw of important severity was found in the perl-DBI Perl database interface module, affecting the perl-DBI packages in Red Hat Enterprise Linux 6, 7, 8, 9, and 10 (including the perl-DBI:1.641 module streams on RHEL 8) and in Red Hat In-Vehicle OS. When the DBI `preparse` method rewrites a SQL statement containing `?` placeholders, each placeholder is expanded to a numbered binder of the form `:pN`, but the destination buffer was allocated assuming only three characters per binder. A statement with more than 9 placeholders generates binders with two or more digits (for example `:p1003`), so the expanded statement can exceed the allocated buffer and overflow the heap. An attacker who can influence a SQL statement that an application using the vulnerable preparse path prepares could exploit this to crash the application, causing a denial of service, or potentially achieve memory corruption leading to arbitrary code execution. Red Hat rates this flaw as IMPORTANT with a CVSS 3.1 score of 7.7 (AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H), lower than the CISA score of 9.8 that assumes a network attack vector, because exploitation requires a local application to pass attacker-controlled SQL through the affected preparse code path rather than direct network exposure of the flaw itself, and Red Hat\u0027s scoring reflects no direct confidentiality impact. The affected Red Hat Enterprise Linux and Red Hat In-Vehicle OS streams are tracked as AFFECTED, with fixes being pursued for those streams; Fedora is not affected because the vulnerable code is not present in its perl-DBI packages.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-0:1.641-2.el8_10.aarch64",
          "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-0:1.641-2.el8_10.ppc64le",
          "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-0:1.641-2.el8_10.src",
          "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-0:1.641-2.el8_10.x86_64",
          "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debuginfo-0:1.641-2.el8_10.aarch64",
          "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debuginfo-0:1.641-2.el8_10.ppc64le",
          "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debuginfo-0:1.641-2.el8_10.x86_64",
          "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debugsource-0:1.641-2.el8_10.aarch64",
          "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debugsource-0:1.641-2.el8_10.ppc64le",
          "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debugsource-0:1.641-2.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-10879"
        },
        {
          "category": "external",
          "summary": "RHBZ#2485464",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2485464"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-10879",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-10879"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-10879",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10879"
        },
        {
          "category": "external",
          "summary": "https://github.com/perl5-dbi/dbi/commit/af79036c07aa9a457971c0f4136e37c85dc20978.patch",
          "url": "https://github.com/perl5-dbi/dbi/commit/af79036c07aa9a457971c0f4136e37c85dc20978.patch"
        },
        {
          "category": "external",
          "summary": "https://metacpan.org/release/HMBRAND/DBI-1.648/changes",
          "url": "https://metacpan.org/release/HMBRAND/DBI-1.648/changes"
        }
      ],
      "release_date": "2026-06-05T14:30:58.497000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-02T15:09:54+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-0:1.641-2.el8_10.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-0:1.641-2.el8_10.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-0:1.641-2.el8_10.src",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-0:1.641-2.el8_10.x86_64",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debuginfo-0:1.641-2.el8_10.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debuginfo-0:1.641-2.el8_10.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debuginfo-0:1.641-2.el8_10.x86_64",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debugsource-0:1.641-2.el8_10.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debugsource-0:1.641-2.el8_10.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debugsource-0:1.641-2.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:62667"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-0:1.641-2.el8_10.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-0:1.641-2.el8_10.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-0:1.641-2.el8_10.src",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-0:1.641-2.el8_10.x86_64",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debuginfo-0:1.641-2.el8_10.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debuginfo-0:1.641-2.el8_10.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debuginfo-0:1.641-2.el8_10.x86_64",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debugsource-0:1.641-2.el8_10.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debugsource-0:1.641-2.el8_10.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debugsource-0:1.641-2.el8_10.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-0:1.641-2.el8_10.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-0:1.641-2.el8_10.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-0:1.641-2.el8_10.src",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-0:1.641-2.el8_10.x86_64",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debuginfo-0:1.641-2.el8_10.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debuginfo-0:1.641-2.el8_10.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debuginfo-0:1.641-2.el8_10.x86_64",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debugsource-0:1.641-2.el8_10.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debugsource-0:1.641-2.el8_10.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debugsource-0:1.641-2.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "perl-DBI: perl-DBI: Heap overflow in SQL preparsing can lead to denial of service or arbitrary code execution."
    },
    {
      "cve": "CVE-2026-14380",
      "cwe": {
        "id": "CWE-94",
        "name": "Improper Control of Generation of Code"
      },
      "discovery_date": "2026-07-07T23:01:46.376740+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2497915"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the DBI component for Perl. This vulnerability allows an attacker to inject and execute arbitrary code by manipulating the Profile attribute of a DBI handle. When a string is assigned to this attribute, the component processes it without proper validation, enabling the execution of unauthorized Perl code, including system commands. An attacker with control over certain inputs, such as environment variables or connection string parameters, could exploit this to achieve arbitrary code execution on the affected system. In some configurations, this could lead to remote code execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "DBI: DBI: Arbitrary code execution via caller-influenced Profile attribute",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important vulnerability in the Perl DBI component allows for arbitrary code execution due to improper validation of the `Profile` attribute. An attacker can exploit this by controlling inputs such as the `DBI_PROFILE` environment variable or DSN parameters, leading to the execution of unauthorized Perl code.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-0:1.641-2.el8_10.aarch64",
          "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-0:1.641-2.el8_10.ppc64le",
          "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-0:1.641-2.el8_10.src",
          "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-0:1.641-2.el8_10.x86_64",
          "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debuginfo-0:1.641-2.el8_10.aarch64",
          "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debuginfo-0:1.641-2.el8_10.ppc64le",
          "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debuginfo-0:1.641-2.el8_10.x86_64",
          "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debugsource-0:1.641-2.el8_10.aarch64",
          "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debugsource-0:1.641-2.el8_10.ppc64le",
          "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debugsource-0:1.641-2.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-14380"
        },
        {
          "category": "external",
          "summary": "RHBZ#2497915",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497915"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-14380",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-14380"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-14380",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14380"
        },
        {
          "category": "external",
          "summary": "https://github.com/perl5-dbi/dbi/commit/b73d5d9901767fc1d16b6661ef08fbed4532e259.patch",
          "url": "https://github.com/perl5-dbi/dbi/commit/b73d5d9901767fc1d16b6661ef08fbed4532e259.patch"
        },
        {
          "category": "external",
          "summary": "https://github.com/perl5-dbi/dbi/security/advisories/GHSA-ch8w-hxc2-v557",
          "url": "https://github.com/perl5-dbi/dbi/security/advisories/GHSA-ch8w-hxc2-v557"
        },
        {
          "category": "external",
          "summary": "https://metacpan.org/release/HMBRAND/DBI-1.650/changes",
          "url": "https://metacpan.org/release/HMBRAND/DBI-1.650/changes"
        }
      ],
      "release_date": "2026-07-07T22:04:49.078000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-02T15:09:54+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-0:1.641-2.el8_10.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-0:1.641-2.el8_10.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-0:1.641-2.el8_10.src",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-0:1.641-2.el8_10.x86_64",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debuginfo-0:1.641-2.el8_10.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debuginfo-0:1.641-2.el8_10.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debuginfo-0:1.641-2.el8_10.x86_64",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debugsource-0:1.641-2.el8_10.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debugsource-0:1.641-2.el8_10.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debugsource-0:1.641-2.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:62667"
        },
        {
          "category": "workaround",
          "details": "To reduce the risk of arbitrary code execution, avoid setting the `DBI_PROFILE` environment variable from untrusted sources. Ensure that DSN driver-attribute clauses, particularly those used with `dbi:Driver(Profile=\u003eSPEC):db`, are not populated with unvalidated or untrusted input.",
          "product_ids": [
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-0:1.641-2.el8_10.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-0:1.641-2.el8_10.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-0:1.641-2.el8_10.src",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-0:1.641-2.el8_10.x86_64",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debuginfo-0:1.641-2.el8_10.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debuginfo-0:1.641-2.el8_10.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debuginfo-0:1.641-2.el8_10.x86_64",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debugsource-0:1.641-2.el8_10.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debugsource-0:1.641-2.el8_10.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debugsource-0:1.641-2.el8_10.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-0:1.641-2.el8_10.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-0:1.641-2.el8_10.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-0:1.641-2.el8_10.src",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-0:1.641-2.el8_10.x86_64",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debuginfo-0:1.641-2.el8_10.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debuginfo-0:1.641-2.el8_10.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debuginfo-0:1.641-2.el8_10.x86_64",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debugsource-0:1.641-2.el8_10.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debugsource-0:1.641-2.el8_10.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debugsource-0:1.641-2.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "DBI: DBI: Arbitrary code execution via caller-influenced Profile attribute"
    },
    {
      "cve": "CVE-2026-14739",
      "cwe": {
        "id": "CWE-131",
        "name": "Incorrect Calculation of Buffer Size"
      },
      "discovery_date": "2026-07-07T23:01:49.265768+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2497916"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in DBI for Perl. This vulnerability, a heap overflow, occurs when the software attempts to preparse SQL statements containing an extremely large number of placeholders. This could allow a remote attacker to cause a denial of service or potentially execute arbitrary code.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "DBI: DBI: Heap overflow when preparsing SQL statements with excessive placeholders",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability in DBI for Perl is rated as Important. A heap overflow can occur when processing SQL statements with an exceptionally large number of placeholders, potentially leading to a denial of service or arbitrary code execution. While requiring an extreme number of placeholders, this flaw could impact applications utilizing DBI in Red Hat environments that handle untrusted or maliciously crafted SQL queries.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-0:1.641-2.el8_10.aarch64",
          "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-0:1.641-2.el8_10.ppc64le",
          "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-0:1.641-2.el8_10.src",
          "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-0:1.641-2.el8_10.x86_64",
          "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debuginfo-0:1.641-2.el8_10.aarch64",
          "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debuginfo-0:1.641-2.el8_10.ppc64le",
          "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debuginfo-0:1.641-2.el8_10.x86_64",
          "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debugsource-0:1.641-2.el8_10.aarch64",
          "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debugsource-0:1.641-2.el8_10.ppc64le",
          "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debugsource-0:1.641-2.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-14739"
        },
        {
          "category": "external",
          "summary": "RHBZ#2497916",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497916"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-14739",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-14739"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-14739",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14739"
        },
        {
          "category": "external",
          "summary": "https://github.com/perl5-dbi/dbi/commit/2b77c88b655e9539a592c71a61fb965fc0075395.patch",
          "url": "https://github.com/perl5-dbi/dbi/commit/2b77c88b655e9539a592c71a61fb965fc0075395.patch"
        },
        {
          "category": "external",
          "summary": "https://metacpan.org/release/HMBRAND/DBI-1.650/changes",
          "url": "https://metacpan.org/release/HMBRAND/DBI-1.650/changes"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-10879",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-10879"
        }
      ],
      "release_date": "2026-07-07T22:05:18.457000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-02T15:09:54+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-0:1.641-2.el8_10.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-0:1.641-2.el8_10.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-0:1.641-2.el8_10.src",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-0:1.641-2.el8_10.x86_64",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debuginfo-0:1.641-2.el8_10.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debuginfo-0:1.641-2.el8_10.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debuginfo-0:1.641-2.el8_10.x86_64",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debugsource-0:1.641-2.el8_10.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debugsource-0:1.641-2.el8_10.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debugsource-0:1.641-2.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:62667"
        },
        {
          "category": "workaround",
          "details": "Applications utilizing `perl-DBI` should implement robust input validation and limit the number of parameters used in SQL query placeholders, particularly when processing untrusted data. This operational control can prevent the construction of SQL statements with an excessive number of placeholders, thereby reducing the risk of triggering the heap overflow vulnerability.",
          "product_ids": [
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-0:1.641-2.el8_10.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-0:1.641-2.el8_10.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-0:1.641-2.el8_10.src",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-0:1.641-2.el8_10.x86_64",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debuginfo-0:1.641-2.el8_10.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debuginfo-0:1.641-2.el8_10.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debuginfo-0:1.641-2.el8_10.x86_64",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debugsource-0:1.641-2.el8_10.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debugsource-0:1.641-2.el8_10.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debugsource-0:1.641-2.el8_10.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-0:1.641-2.el8_10.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-0:1.641-2.el8_10.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-0:1.641-2.el8_10.src",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-0:1.641-2.el8_10.x86_64",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debuginfo-0:1.641-2.el8_10.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debuginfo-0:1.641-2.el8_10.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debuginfo-0:1.641-2.el8_10.x86_64",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debugsource-0:1.641-2.el8_10.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debugsource-0:1.641-2.el8_10.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:perl-DBI-debugsource-0:1.641-2.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "DBI: DBI: Heap overflow when preparsing SQL statements with excessive placeholders"
    }
  ]
}

CVE-2026-10879 (GCVE-0-2026-10879)

Vulnerability from cvelistv5 – Published: 2026-06-05 14:30 – Updated: 2026-06-08 16:55

Title

DBI versions before 1.648 for Perl have a heap overflow when preparsing SQL statements with more than 9 binders

Summary

DBI versions before 1.648 for Perl have a heap overflow when preparsing SQL statements with more than 9 binders. The preparse method expands SQL placeholder characters to numbered binders of the form :pN, but only allocates three characters per binder in the buffer. Placeholders 10-99 require four characters, 100-999 require five characters, et cetera.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-08 16:54 UTC

CWE

CWE-787 - (Out-of-bounds Write)

Assigner

CPANSec CNA under the redhat root

CNA scorecard C 62/100 over 369 records in the last 180 days details

References

3 references

URL	Tags
https://metacpan.org/release/HMBRAND/DBI-1.648/changes	release-notes
https://github.com/perl5-dbi/dbi/commit/af79036c0…	patch
http://www.openwall.com/lists/oss-security/2026/06/06/4

Impacted products

1 product

Vendor	Product	Version
HMBRAND	DBI	Affected: 0 , < 1.648 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-06-06T05:18:05.204Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/06/06/4"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-10879",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-08T16:54:58.795048Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-08T16:55:27.339Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://cpan.org/modules",
          "defaultStatus": "unaffected",
          "packageName": "DBI",
          "product": "DBI",
          "programFiles": [
            "DBI.xs"
          ],
          "repo": "https://github.com/perl5-dbi/dbi",
          "vendor": "HMBRAND",
          "versions": [
            {
              "lessThan": "1.648",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "DBI versions before 1.648 for Perl have a heap overflow when preparsing SQL statements with more than 9 binders.\n\nThe preparse method expands SQL placeholder characters to numbered binders of the form :pN, but only allocates three characters per binder in the buffer.  Placeholders 10-99 require four characters, 100-999 require five characters, et cetera."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "CWE-787 (Out-of-bounds Write)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-05T14:30:58.497Z",
        "orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
        "shortName": "CPANSec"
      },
      "references": [
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://metacpan.org/release/HMBRAND/DBI-1.648/changes"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/perl5-dbi/dbi/commit/af79036c07aa9a457971c0f4136e37c85dc20978.patch"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to DBI 1.648 or later."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2026-04-25T00:00:00.000Z",
          "value": "Issue reported to CPANSec."
        },
        {
          "lang": "en",
          "time": "2026-05-28T00:00:00.000Z",
          "value": "Commit fixed the issue in DBI."
        },
        {
          "lang": "en",
          "time": "2026-06-04T00:00:00.000Z",
          "value": "DBI 1.648 released."
        }
      ],
      "title": "DBI versions before 1.648 for Perl have a heap overflow when preparsing SQL statements with more than 9 binders",
      "x_generator": {
        "engine": "cpansec-cna-tool 0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
    "assignerShortName": "CPANSec",
    "cveId": "CVE-2026-10879",
    "datePublished": "2026-06-05T14:30:58.497Z",
    "dateReserved": "2026-06-04T16:34:48.978Z",
    "dateUpdated": "2026-06-08T16:55:27.339Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-14380 (GCVE-0-2026-14380)

Vulnerability from cvelistv5 – Published: 2026-07-07 22:04 – Updated: 2026-08-31 10:12

Title

DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile

Summary

DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile. When a string is assigned to a DBI handle's Profile attribute, DBI splits it into path, package and arguments, and interpolates the package part in a string eval with no validation of the package name. Any caller-influenced value that reaches the Profile attribute is therefore arbitrary Perl code execution, including calls to run system commands. The Profile attribute can be set from three different sources that can carry untrusted data: the DBI_PROFILE environment variable, a direct attribute assignment, and a DSN driver-attribute clause dbi:Driver(Profile=>SPEC):db. An attacker controlling any of those inputs runs arbitrary Perl in the host process. The strongest remote position is a network-exposed DBI::Gofer / DBI::ProxyServer whose per-request DSN reaches the Profile attribute, letting a client execute code on the broker host.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-09 13:51 UTC

CWE

CWE-95 - Improper Neutralization of Directives in Dynamically Evaluated Code (Eval Injection)
CWE-470 - Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

Assigner

CPANSec CNA under the redhat root

CNA scorecard C 62/100 over 369 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/perl5-dbi/dbi/commit/b73d5d990…	patch
https://github.com/perl5-dbi/dbi/security/advisor…	vendor-advisory
https://metacpan.org/release/HMBRAND/DBI-1.650/changes	release-notes
http://www.openwall.com/lists/oss-security/2026/0…

Impacted products

1 product

Vendor	Product	Version
		Affected: 0 , < 1.650 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-07-08T00:28:31.619Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/07/07/16"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-14380",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-09T13:51:52.778631Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-09T14:41:58.100Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://cpan.org/modules",
          "defaultStatus": "unaffected",
          "modules": [
            "DBI"
          ],
          "packageName": "DBI",
          "packageURL": "pkg:cpan/DBI",
          "programFiles": [
            "lib/DBI/Profile.pm"
          ],
          "programRoutines": [
            {
              "name": "DBI::Profile::_auto_new"
            }
          ],
          "repo": "https://github.com/perl5-dbi/dbi",
          "versions": [
            {
              "lessThan": "1.650",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile.\n\nWhen a string is assigned to a DBI handle\u0027s Profile attribute, DBI splits it into path, package and arguments, and interpolates the package part in a string eval with no validation of the package name.\n\nAny caller-influenced value that reaches the Profile attribute is therefore arbitrary Perl code execution, including calls to run system commands.\n\nThe Profile attribute can be set from three different sources that can carry untrusted data: the DBI_PROFILE environment variable, a direct attribute assignment, and a DSN driver-attribute clause dbi:Driver(Profile=\u003eSPEC):db.\n\nAn attacker controlling any of those inputs runs arbitrary Perl in the host process. The strongest remote position is a network-exposed DBI::Gofer / DBI::ProxyServer whose per-request DSN reaches the Profile attribute, letting a client execute code on the broker host."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-242",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-242 Code Injection"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-95",
              "description": "CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code (Eval Injection)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-470",
              "description": "CWE-470 Use of Externally-Controlled Input to Select Classes or Code (\u0027Unsafe Reflection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-31T10:12:09.285Z",
        "orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
        "shortName": "CPANSec"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/perl5-dbi/dbi/commit/b73d5d9901767fc1d16b6661ef08fbed4532e259.patch"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/perl5-dbi/dbi/security/advisories/GHSA-ch8w-hxc2-v557"
        },
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://metacpan.org/release/HMBRAND/DBI-1.650/changes"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to DBI version 1.650 or later."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile",
      "x_generator": {
        "engine": "cpansec-cna-tool 0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
    "assignerShortName": "CPANSec",
    "cveId": "CVE-2026-14380",
    "datePublished": "2026-07-07T22:04:49.078Z",
    "dateReserved": "2026-07-01T21:17:54.504Z",
    "dateUpdated": "2026-08-31T10:12:09.285Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-14739 (GCVE-0-2026-14739)

Vulnerability from cvelistv5 – Published: 2026-07-07 22:05 – Updated: 2026-07-08 13:56

Title

DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders

Summary

DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders. The fix for CVE-2026-10879 did not allocate enough memory to handle approximately 1.2-million placeholders. DBI version 1.650 sets a hard limit of 99,999 placeholders.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-08 13:55 UTC

CWE

CWE-787 - Out-of-bounds Write

Assigner

CPANSec CNA under the redhat root

CNA scorecard C 62/100 over 369 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/perl5-dbi/dbi/commit/2b77c88b6…	patch
https://www.cve.org/CVERecord?id=CVE-2026-10879	vendor-advisoryrelated
https://metacpan.org/release/HMBRAND/DBI-1.650/changes	release-notes

Impacted products

1 product

Vendor	Product	Version
HMBRAND	DBI	Affected: 0 , < 1.650 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-14739",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-08T13:55:38.504631Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-08T13:56:43.597Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://cpan.org/modules",
          "defaultStatus": "unaffected",
          "packageName": "DBI",
          "product": "DBI",
          "programFiles": [
            "DBI.xs"
          ],
          "programRoutines": [
            {
              "name": "preparse"
            }
          ],
          "repo": "https://github.com/perl5-dbi/dbi",
          "vendor": "HMBRAND",
          "versions": [
            {
              "lessThan": "1.650",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders.\n\nThe fix for CVE-2026-10879 did not allocate enough memory to handle approximately 1.2-million placeholders.\n\nDBI version 1.650 sets a hard limit of 99,999 placeholders."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "CWE-787 Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-07T22:05:18.457Z",
        "orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
        "shortName": "CPANSec"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/perl5-dbi/dbi/commit/2b77c88b655e9539a592c71a61fb965fc0075395.patch"
        },
        {
          "tags": [
            "vendor-advisory",
            "related"
          ],
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-10879"
        },
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://metacpan.org/release/HMBRAND/DBI-1.650/changes"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to DBI version 1.650 or later."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2026-06-04T00:00:00.000Z",
          "value": "Version 1.648 released with a fix for CVE-2026-10879."
        },
        {
          "lang": "en",
          "time": "2026-07-07T00:00:00.000Z",
          "value": "Version 1.650 released."
        }
      ],
      "title": "DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders",
      "x_generator": {
        "engine": "cpansec-cna-tool 0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
    "assignerShortName": "CPANSec",
    "cveId": "CVE-2026-14739",
    "datePublished": "2026-07-07T22:05:18.457Z",
    "dateReserved": "2026-07-04T09:24:31.098Z",
    "dateUpdated": "2026-07-08T13:56:43.597Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-9698 (GCVE-0-2026-9698)

Vulnerability from cvelistv5 – Published: 2026-06-09 07:22 – Updated: 2026-09-03 12:04

Title

DBI versions before 1.648 for Perl saved errors in a limited-sized buffer

Summary

DBI versions before 1.648 for Perl saved errors in a limited-sized buffer. Error messages that were returned when RaiseError, PrintError or HandleError were set were written to a 200-byte buffer without a length limit. Attackers that can influence the error text in an application can trigger a buffer overflow.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

8.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-09 15:44 UTC

CWE

CWE-787 - Out-of-bounds Write
CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Assigner

CPANSec CNA under the redhat root

CNA scorecard C 62/100 over 369 records in the last 180 days details

References

11 references

URL	Tags
https://metacpan.org/release/HMBRAND/DBI-1.648/changes	release-notes
https://github.com/perl5-dbi/dbi/commit/bfe5d73c1…	patch
http://www.openwall.com/lists/oss-security/2026/06/09/9
https://access.redhat.com/security/cve/CVE-2026-9698	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2486734	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:38513	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:38901	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:38512	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:62667	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:53371	vendor-advisoryx_refsource_REDHAT

Impacted products

8 products

Vendor	Product	Version
HMBRAND	DBI	Affected: 0 , < 1.648 (custom)
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:1.643-26.el10_2.1 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 8100020260624081239.69ef70f8 , < * (rpm) cpe:/a:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:1.643-9.el9_8.1 , < * (rpm) cpe:/a:redhat:enterprise_linux:9
Red Hat	Red Hat Insights proxy 1.5	Unaffected: 1786433656 , < * (rpm) cpe:/a:redhat:insights_proxy:1.5::el9
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-06-09T11:03:32.648Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/06/09/9"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-9698",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-09T15:44:04.195929Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-09T15:44:21.456Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "perl-DBI",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.643-26.el10_2.1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "perl-DBI:1.641",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8100020260624081239.69ef70f8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "perl-DBI",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.643-9.el9_8.1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:insights_proxy:1.5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "insights-proxy/insights-proxy-container-rhel9",
            "product": "Red Hat Insights proxy 1.5",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786433656",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:6"
            ],
            "defaultStatus": "unknown",
            "packageName": "perl-DBI",
            "product": "Red Hat Enterprise Linux 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "affected",
            "packageName": "perl-DBI",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "perl-DBI",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-06-09T07:22:25.892Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in DBI, a Perl database interface. This vulnerability allows an attacker to trigger a buffer overflow by manipulating error messages within an application. When specific error handling options are active, an attacker can provide oversized error text, which may lead to arbitrary code execution or a denial of service (DoS)."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.2,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-120",
                "description": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-03T12:04:41.975Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-9698"
          },
          {
            "name": "RHBZ#2486734",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486734"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-9698.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:38513"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:38901"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:38512"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:62667"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:53371"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:38513: Red Hat Enterprise Linux AppStream (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:38901: Red Hat Enterprise Linux AppStream (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:38512: Red Hat Enterprise Linux AppStream (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:62667: Red Hat Enterprise Linux BaseOS (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:53371: Red Hat Insights proxy 1.5"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-06-09T08:00:53.401Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-06-09T07:22:25.892Z",
            "value": "Made public."
          }
        ],
        "title": "DBI: DBI: Buffer overflow in error handling can lead to arbitrary code execution",
        "workarounds": [
          {
            "lang": "en",
            "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Users are advised to identify network-accessible applications which use perl-DBI and ensure that only trusted users have access to those applications."
          }
        ],
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://cpan.org/modules",
          "defaultStatus": "unaffected",
          "packageName": "DBI",
          "product": "DBI",
          "programFiles": [
            "DBI.xs"
          ],
          "repo": "https://github.com/perl5-dbi/dbi",
          "vendor": "HMBRAND",
          "versions": [
            {
              "lessThan": "1.648",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "DBI versions before 1.648 for Perl saved errors in a limited-sized buffer.\n\nError messages that were returned when RaiseError, PrintError or HandleError were set were written to a 200-byte buffer without a length limit.\n\nAttackers that can influence the error text in an application can trigger a buffer overflow."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "CWE-787 Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-09T07:22:25.892Z",
        "orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
        "shortName": "CPANSec"
      },
      "references": [
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://metacpan.org/release/HMBRAND/DBI-1.648/changes"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/perl5-dbi/dbi/commit/bfe5d73c162d2d1f761a639a0aa33aad6a9eb54e.patch"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to DBI 1.648 or later."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2026-04-25T00:00:00.000Z",
          "value": "Issue reported to CPANSec."
        },
        {
          "lang": "en",
          "time": "2026-05-27T00:00:00.000Z",
          "value": "Commit fixed the issue in DBI."
        },
        {
          "lang": "en",
          "time": "2026-06-04T00:00:00.000Z",
          "value": "DBI 1.648 released."
        }
      ],
      "title": "DBI versions before 1.648 for Perl saved errors in a limited-sized buffer",
      "x_generator": {
        "engine": "cpansec-cna-tool 0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
    "assignerShortName": "CPANSec",
    "cveId": "CVE-2026-9698",
    "datePublished": "2026-06-09T07:22:25.892Z",
    "dateReserved": "2026-05-27T12:06:43.461Z",
    "dateUpdated": "2026-09-03T12:04:41.975Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2026:62667

CVE-2026-10879 (GCVE-0-2026-10879)

CVE-2026-14380 (GCVE-0-2026-14380)

CVE-2026-14739 (GCVE-0-2026-14739)

CVE-2026-9698 (GCVE-0-2026-9698)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour