Executive brief
The Perl DBI library, a standard database interface for the Perl programming language, contains a memory management flaw when processing complex SQL statements. If an application uses DBI to process SQL queries containing more than nine placeholders (binders), it could lead to a system crash or potentially allow an attacker to execute unauthorized code. This could impact the availability of database-driven applications or lead to unauthorized data access.
Technical details
A heap-based buffer overflow exists in the `preparse` method of the Perl DBI library. The vulnerability is caused by an insufficient memory allocation strategy when expanding SQL placeholder characters (e.g., '?') into numbered binders (e.g., ':p10'). The code originally allocated only three characters per binder, which is insufficient for binders 10 and above (e.g., ':p10' requires 4 characters, ':p100' requires 5). An attacker who can influence the SQL statements passed to the preparse method—typically via an application that dynamically constructs queries with many placeholders—could trigger an out-of-bounds write. This can result in a denial of service or potentially arbitrary code execution. The issue is fixed in version 1.648 by increasing the allocation buffer size.
Affected products
- Perl DBI < 1.648
Timeline
- 2026-05-28: patched: Patch committed to DBI repository
- 2026-06-04: advisory: Version 1.648 released with fix
- 2026-06-05: disclosed: CVE-2026-10879 published