Executive brief
DBI is a standard database interface module for the Perl programming language. A vulnerability was discovered where the library fails to properly validate data when a database query returns rows but the application expects zero columns. This can lead to a program crash or memory instability, potentially causing a denial of service for applications processing untrusted database metadata.
Technical details
An out-of-bounds read vulnerability (CWE-125) exists in the DBI XS row-buffer helper function `_set_fbav` in `DBI.xs`. When a statement handle is prepared with zero fields (e.g., via DBD::Sponge or inconsistent metadata) but a non-empty source row is provided, the internal buffer logic attempts to grow the array starting from a negative index (`dst_fields - 1`). This results in a read from `AvARRAY(dst_av)[-1]`. On standard builds, this typically causes a process crash (SIGSEGV) due to reading a garbage pointer; in hardened or ASAN builds, it is identified as a heap-buffer-overflow read. The issue is fixed in version 1.651 by adding a check that croaks if a non-empty row is set against a zero-field buffer.
Affected products
- HMBRAND DBI before 1.651
Timeline
- 2026-07-10: patched: Fix committed to GitHub repository
- 2026-07-14: advisory: GHSA-rwhc-hhmv-cjvg published
- 2026-07-14: disclosed: CVE-2026-60082 published