# CVE-2026-10879: Perl DBI heap overflow in preparse SQL statement expansion

Source: https://junglewise.ai/threats/cve-2026-10879-perl-dbi-heap-overflow-in-preparse-sql-statement-expansion  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-05. Updated: 2026-06-05  
License: CC BY 4.0 with a link back

CVE-2026-10879 · Severity: info · CVSS 0 · Published 2026-06-05

The Perl DBI library, a standard database interface for the Perl programming language, contains a memory management flaw when processing complex SQL statements. If an application uses DBI to process SQL queries containing more than nine placeholders (binders), it could lead to a system crash or potentially allow an attacker to execute unauthorized code. This could impact the availability of database-driven applications or lead to unauthorized data access.

Technologies: [Perl DBI Team DBI](https://junglewise.ai/threats/technologies/dbi). Vendors: [Perl DBI Team](https://junglewise.ai/threats/vendors/perl-dbi-team).

## Quick answers

**Is CVE-2026-10879 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-10879 being exploited in the wild.

**How severe is CVE-2026-10879?** Informational severity, with a CVSS score of 0, published 5 June 2026.

**Which products and versions are affected?** Perl DBI Team DBI < 1.648.

**Is there a fix for CVE-2026-10879?** A patch was published on 2026-05-28: Patch committed to DBI repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-10879 attacked?** It is attacked with local access or over the network, in a software library.

**Am I affected by CVE-2026-10879?** Check whether you run Perl DBI Team DBI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A heap-based buffer overflow exists in the `preparse` method of the Perl DBI library. The vulnerability is caused by an insufficient memory allocation strategy when expanding SQL placeholder characters (e.g., '?') into numbered binders (e.g., ':p10'). The code originally allocated only three characters per binder, which is insufficient for binders 10 and above (e.g., ':p10' requires 4 characters, ':p100' requires 5). An attacker who can influence the SQL statements passed to the preparse method—typically via an application that dynamically constructs queries with many placeholders—could trigger an out-of-bounds write. This can result in a denial of service or potentially arbitrary code execution. The issue is fixed in version 1.648 by increasing the allocation buffer size.

## Affected products

- Perl DBI < 1.648

## Timeline

- 2026-05-28: patched: Patch committed to DBI repository
- 2026-06-04: advisory: Version 1.648 released with fix
- 2026-06-05: disclosed: CVE-2026-10879 published

## References

- [https://github.com/perl5-dbi/dbi/commit/af79036c07aa9a457971c0f4136e37c85dc20978.patch](https://github.com/perl5-dbi/dbi/commit/af79036c07aa9a457971c0f4136e37c85dc20978.patch)
- [https://metacpan.org/release/HMBRAND/DBI-1.648/changes](https://metacpan.org/release/HMBRAND/DBI-1.648/changes)

## Related threats

- [Perl DBI memory exhaustion in DBI::ProfileData parser](https://junglewise.ai/threats/cve-2026-60081-perl-dbi-memory-exhaustion-in-dbi-profiledata-parser)
- [Perl DBI code injection in Profile attribute](https://junglewise.ai/threats/cve-2026-14380-perl-dbi-code-injection-in-profile-attribute)
- [Perl DBI stack buffer overflow in error handling](https://junglewise.ai/threats/cve-2026-9698-perl-dbi-stack-buffer-overflow-in-error-handling)