Quick answers
- Is CVE-2026-10879 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-10879 being exploited in the wild.
- How severe is CVE-2026-10879?
- Informational severity, with a CVSS score of 0, published 5 June 2026.
- Which products and versions are affected?
- Perl DBI Team DBI < 1.648.
- Is there a fix for CVE-2026-10879?
- A patch was published on 2026-05-28: Patch committed to DBI repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-10879 attacked?
- It is attacked with local access or over the network, in a software library.
- Am I affected by CVE-2026-10879?
- Check whether you run Perl DBI Team DBI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A heap-based buffer overflow exists in the `preparse` method of the Perl DBI library. The vulnerability is caused by an insufficient memory allocation strategy when expanding SQL placeholder characters (e.g., '?') into numbered binders (e.g., ':p10'). The code originally allocated only three characters per binder, which is insufficient for binders 10 and above (e.g., ':p10' requires 4 characters, ':p100' requires 5). An attacker who can influence the SQL statements passed to the preparse method—typically via an application that dynamically constructs queries with many placeholders—could trigger an out-of-bounds write. This can result in a denial of service or potentially arbitrary code execution. The issue is fixed in version 1.648 by increasing the allocation buffer size.
Affected products
- Perl DBI < 1.648
Timeline
- 2026-05-28: patched: Patch committed to DBI repository
- 2026-06-04: advisory: Version 1.648 released with fix
- 2026-06-05: disclosed: CVE-2026-10879 published