Executive brief
The Perl DBI library, a standard database interface for the Perl programming language, is vulnerable to a memory corruption issue when processing SQL statements. An attacker who can provide a specially crafted SQL query containing over one million placeholders could cause the application to crash or potentially execute unauthorized code. This issue stems from an incomplete fix for a previous security vulnerability regarding how the library allocates memory for large queries.
Technical details
A heap overflow vulnerability exists in the `preparse` function within `DBI.xs` of the Perl DBI module. The root cause is an insufficient memory allocation strategy that fails when handling approximately 1.2 million '?' placeholders, as the previous fix for CVE-2026-10879 did not account for such extreme cases. An attacker capable of passing a crafted SQL statement to the preparse routine can trigger an out-of-bounds write. The vulnerability is addressed in version 1.650 by increasing the allocation factor and implementing a hard limit of 99,999 placeholders.
Affected products
- HMBRAND DBI before 1.650
Timeline
- 2026-07-04: patched: Fix committed to repository and version 1.650 released.
- 2026-07-07: disclosed: CVE-2026-14739 published.