CVE-2026-9698

DBI versions before 1.648 for Perl saved errors in a limited-sized buffer.

Error messages that were returned when RaiseError, PrintError or HandleError were set were written to a 200-byte buffer without a length limit.

Attackers that can influence the error text in an application can trigger a buffer overflow.

DBI versions before 1.648 for Perl saved errors in a limited-sized buffer. Error messages that were returned when RaiseError, PrintError or HandleError were set were written to a 200-byte buffer without a length limit. Attackers that can influence the error text in an application can trigger a buffer overflow.

The DBI is the standard database interface module for Perl. It defines a set of methods, variables and conventions that provide a consistent database interface independent of the actual database being used. It is important to remember that the DBI is just an interface. The DBI is a layer of "glue" between an application and one or more database driver modules. It is the driver modules which do most of the real work. The DBI provides a standard interface and framework for the drivers to operate within.

Security Fix(es):

DBI versions before 1.648 for Perl have a heap overflow when preparsing SQL statements with more than 9 binders.

The preparse method expands SQL placeholder characters to numbered binders of the form :pN, but only allocates three characters per binder in the buffer. Placeholders 10-99 require four characters, 100-999 require five characters, et cetera.(CVE-2026-10879)

DBI versions before 1.648 for Perl saved errors in a limited-sized buffer.

Error messages that were returned when RaiseError, PrintError or HandleError were set were written to a 200-byte buffer without a length limit.

Attackers that can influence the error text in an application can trigger a buffer overflow.(CVE-2026-9698)

DBI is a database access Application Programming Interface (API) for the Perl Language. The DBI API Specification defines a set of functions, variables and conventions that provide a consistent database interface independent of the actual database being used.

Security Fix(es):

• DBI: DBI: Buffer overflow in error handling can lead to arbitrary code execution (CVE-2026-9698)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

DBI is a database access Application Programming Interface (API) for the Perl Language. The DBI API Specification defines a set of functions, variables and conventions that provide a consistent database interface independent of the actual database being used.

Security Fix(es):

• DBI: DBI: Buffer overflow in error handling can lead to arbitrary code execution (CVE-2026-9698)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The perl-DBI package provides the standard database interface module for the Perl programming language. It implements a database-independent interface, meaning it defines a consistent set of methods, variables, and conventions for database operations.

Security Fix(es):

• DBI: DBI: Buffer overflow in error handling can lead to arbitrary code execution (CVE-2026-9698)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

DBI is a database access Application Programming Interface (API) for the Perl Language. The DBI API Specification defines a set of functions, variables and conventions that provide a consistent database interface independent of the actual database being used.

Security Fix(es):

• perl-DBI: perl-DBI: Heap overflow in SQL preparsing can lead to denial of service or arbitrary code execution. (CVE-2026-10879)

• DBI: DBI: Buffer overflow in error handling can lead to arbitrary code execution (CVE-2026-9698)

• DBI: DBI: Arbitrary code execution via caller-influenced Profile attribute (CVE-2026-14380)

• DBI: DBI: Heap overflow when preparsing SQL statements with excessive placeholders (CVE-2026-14739)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

DBI versions before 1.648 for Perl saved errors in a limited-sized buffer. Error messages that were returned when RaiseError, PrintError or HandleError were set were written to a 200-byte buffer without a length limit. Attackers that can influence the error text in an application can trigger a buffer overflow.

DBI is a database access Application Programming Interface (API) for the Perl Language. The DBI API Specification defines a set of functions, variables and conventions that provide a consistent database interface independent of the actual database being used.

Security Fix(es):

• DBI: DBI: Buffer overflow in error handling can lead to arbitrary code execution (CVE-2026-9698)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

DBI is a database access Application Programming Interface (API) for the Perl Language. The DBI API Specification defines a set of functions, variables and conventions that provide a consistent database interface independent of the actual database being used.

Security Fix(es):

• DBI: DBI: Buffer overflow in error handling can lead to arbitrary code execution (CVE-2026-9698)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The perl-DBI package provides the standard database interface module for the Perl programming language. It implements a database-independent interface, meaning it defines a consistent set of methods, variables, and conventions for database operations.

Security Fix(es):

• DBI: DBI: Buffer overflow in error handling can lead to arbitrary code execution (CVE-2026-9698)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

DBI is a database access Application Programming Interface (API) for the Perl Language. The DBI API Specification defines a set of functions, variables and conventions that provide a consistent database interface independent of the actual database being used.

Security Fix(es):

• perl-DBI: perl-DBI: Heap overflow in SQL preparsing can lead to denial of service or arbitrary code execution. (CVE-2026-10879)
• DBI: DBI: Buffer overflow in error handling can lead to arbitrary code execution (CVE-2026-9698)
• DBI: DBI: Arbitrary code execution via caller-influenced Profile attribute (CVE-2026-14380)
• DBI: DBI: Heap overflow when preparsing SQL statements with excessive placeholders (CVE-2026-14739)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

DBI versions before 1.648 for Perl saved errors in a limited-sized buffer.

Error messages that were returned when RaiseError, PrintError or HandleError were set were written to a 200-byte buffer without a length limit.

Attackers that can influence the error text in an application can trigger a buffer overflow.

• CVE-2026-9698: fix stack overflow and buffer overflow in DBI.xs error handling and preparse()

• CVE-2026-9698: fix stack overflow and buffer overflow in DBI.xs error handling and preparse()

The updated packages fix several security issues.

These are all security issues fixed in the perl-DBI-1.648.0-1.1 package on the GA media of openSUSE Tumbleweed.

This update for perl-DBI fixes the following issues

• CVE-2026-9698: DBI versions before 1.648 for Perl saved errors in a limited-sized buffer (bsc#1267957).
• CVE-2026-10879: SQL statements with more than 9 binders can cause an heap overflow (bsc#1267849).

This update for perl-DBI fixes the following issues

• CVE-2026-9698: DBI versions before 1.648 for Perl saved errors in a limited-sized buffer (bsc#1267957).
• CVE-2026-10879: SQL statements with more than 9 binders can cause an heap overflow (bsc#1267849).

This update for perl-DBI fixes the following issues

• CVE-2026-9698: DBI versions before 1.648 for Perl saved errors in a limited-sized buffer (bsc#1267957).
• CVE-2026-10879: SQL statements with more than 9 binders can cause an heap overflow (bsc#1267849).

This update for perl-DBI fixes the following issue

• CVE-2026-9698: DBI versions before 1.648 for Perl saved errors in a limited-sized buffer (bsc#1267957).

This update for perl-DBI fixes the following issues

• CVE-2026-9698: DBI versions before 1.648 for Perl saved errors in a limited-sized buffer (bsc#1267957).
• CVE-2026-10879: SQL statements with more than 9 binders can cause an heap overflow (bsc#1267849).

This update for perl-DBI fixes the following issue

• CVE-2026-9698: DBI versions before 1.648 for Perl saved errors in a limited-sized buffer (bsc#1267957).