{"id":"CVE-2026-10879","aliases":["ALPINE-CVE-2026-10879","ALSA-2026:38512","ALSA-2026:38513","ALSA-2026:38901","ALSA-2026:62667","AZL-89559","BELL-CVE-2026-10879","DEBIAN-CVE-2026-10879","EUVD-2026-34843","GHSA-c7xw-cj86-m724","MGASA-2026-0308","OESA-2026-2684","RHSA-2026:38512","RHSA-2026:38513","RHSA-2026:38901","RHSA-2026:62667","RLSA-2026:62667","SUSE-SU-2026:22257-1","SUSE-SU-2026:22330-1","SUSE-SU-2026:2749-1","UBUNTU-CVE-2026-10879","USN-8466-1","openSUSE-SU-2026:10986-1","openSUSE-SU-2026:21029-1"],"status":"published","title":"DBI versions before 1.648 for Perl have a heap overflow when preparsing SQL statements with more than 9 binders","description":"DBI versions before 1.648 for Perl have a heap overflow when preparsing SQL statements with more than 9 binders.\n\nThe preparse method expands SQL placeholder characters to numbered binders of the form :pN, but only allocates three characters per binder in the buffer.  Placeholders 10-99 require four characters, 100-999 require five characters, et cetera.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00485,"percentile":0.42079,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2026-06-05T14:30:58Z","modified":"2026-10-29T11:42:25Z","fixes":[{"ecosystem":"Alpine:v3.24","package":"perl-dbi","fixed_in":["1.648-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"perl-DBI","fixed_in":["1.643-5"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"perl-dbi","fixed_in":["1.643-r5"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"perl-dbi","fixed_in":["1.647-r1"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"perl-dbi","fixed_in":["1.648-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libdbi-perl","fixed_in":["1.643-4+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libdbi-perl","fixed_in":["1.647-1+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libdbi-perl","fixed_in":["1.648-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libdbi-perl","fixed_in":["1.630-1ubuntu0.1~esm6"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libdbi-perl","fixed_in":["1.634-1ubuntu0.2+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libdbi-perl","fixed_in":["1.640-1ubuntu0.3+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libdbi-perl","fixed_in":["1.643-1ubuntu0.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"libdbi-perl","fixed_in":["1.643-3ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"libdbi-perl","fixed_in":["1.643-4ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"libdbi-perl","fixed_in":["1.647-1ubuntu0.25.10.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"libdbi-perl","fixed_in":["1.647-1ubuntu0.26.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.24","package":"perl-dbi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.648-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.643-9.el9_8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.643-26.el10_2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.641-5.module_el8.10.0+4219+13f48a6e"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.641-5.module_el8.10.0+4220+8669cc49"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.641-5.module_el8.10.0+4218+c616d9bd"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.641-2.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Azure Linux:3","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.643-5"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"perl-dbi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.643-r4"},{"fixed":"1.643-r5"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"perl-dbi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.647-r0"},{"fixed":"1.647-r1"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"perl-dbi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.643-r3"},{"fixed":"1.648-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.643-4+deb12u1"}]}],"versions":["1.643-4"]},{"source":"osv","ecosystem":"Debian:13","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.647-1+deb13u1"}]}],"versions":["1.647-1"]},{"source":"osv","ecosystem":"Debian:14","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.648-1"}]}],"versions":["1.647-1"]},{"source":"osv","ecosystem":"Mageia:10","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.651.0-1.mga10"}]}],"bundled":9},{"source":"osv","ecosystem":"Mageia:9","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.651.0-1.mga9"}]}],"bundled":9},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.643-4.oe2003sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.643-5.oe2203sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.643-5.oe2403sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.643-5.oe2403sp3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.643-9.el9_8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"perl-DBI-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.643-9.el9_8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"perl-DBI-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.643-9.el9_8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.643-26.el10_2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"perl-DBI-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.643-26.el10_2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"perl-DBI-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.643-26.el10_2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.641-5.module+el8.10.0+24438+dc2220dd"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"perl-DBI-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.641-5.module+el8.10.0+24438+dc2220dd"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"perl-DBI-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.641-5.module+el8.10.0+24438+dc2220dd"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.641-2.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"perl-DBI-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.641-2.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"perl-DBI-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.641-2.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:8","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.641-2.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.647.0-160000.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.647.0-160000.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.647.0-160000.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.647.0-150600.12.11.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.647.0-150600.12.11.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.647.0-150600.12.11.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.630-1ubuntu0.1~esm6"}]}],"versions":["1.627-1","1.628-1","1.630-1","1.630-1ubuntu0.1~esm1","1.630-1ubuntu0.1~esm4","1.630-1ubuntu0.1~esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.634-1ubuntu0.2+esm2"}]}],"versions":["1.633-1","1.634-1","1.634-1build1","1.634-1ubuntu0.1","1.634-1ubuntu0.2","1.634-1ubuntu0.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.640-1ubuntu0.3+esm1"}]}],"versions":["1.637-1","1.639-1","1.640-1","1.640-1ubuntu0.1","1.640-1ubuntu0.2","1.640-1ubuntu0.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.643-1ubuntu0.1+esm1"}]}],"versions":["1.642-1","1.642-1build1","1.643-1","1.643-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.643-3ubuntu0.1"}]}],"versions":["1.643-3build2","1.643-3build3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.643-4ubuntu0.1"}]}],"versions":["1.643-4","1.643-4build1","1.643-4build2","1.643-4build3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.647-1ubuntu0.25.10.1"}]}],"versions":["1.647-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.647-1ubuntu0.26.04.1"}]}],"versions":["1.647-1","1.647-1build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.630-1ubuntu0.1~esm6"}]}],"versions":["1.627-1","1.628-1","1.630-1","1.630-1ubuntu0.1~esm1","1.630-1ubuntu0.1~esm4","1.630-1ubuntu0.1~esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.634-1ubuntu0.2+esm2"}]}],"versions":["1.633-1","1.634-1","1.634-1build1","1.634-1ubuntu0.1","1.634-1ubuntu0.2","1.634-1ubuntu0.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.640-1ubuntu0.3+esm1"}]}],"versions":["1.637-1","1.639-1","1.640-1","1.640-1ubuntu0.1","1.640-1ubuntu0.2","1.640-1ubuntu0.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.643-1ubuntu0.1+esm1"}]}],"versions":["1.642-1","1.642-1build1","1.643-1","1.643-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.643-3ubuntu0.1"}]}],"versions":["1.643-3build2","1.643-3build3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.643-4ubuntu0.1"}]}],"versions":["1.643-4","1.643-4build1","1.643-4build2","1.643-4build3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.647-1ubuntu0.25.10.1"}]}],"versions":["1.647-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.647-1ubuntu0.26.04.1"}]}],"versions":["1.647-1","1.647-1build1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.648.0-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.647.0-160000.3.1"}]}],"bundled":2}],"products":[{"vendor":"hmbrand","product":"dbi"},{"vendor":"perl","product":"dbi"}],"references":[{"url":"https://metacpan.org/release/HMBRAND/DBI-1.648/changes","tags":["release-notes","Release Notes","advisory","article","report"]},{"url":"https://github.com/perl5-dbi/dbi/commit/af79036c07aa9a457971c0f4136e37c85dc20978.patch","tags":["patch","Patch","fix","article","report"]},{"url":"http://www.openwall.com/lists/oss-security/2026/06/06/4","tags":["Mailing List","Third Party Advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10879","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-c7xw-cj86-m724"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-10879","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:38512","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-9698","tags":["report"]},{"url":"https://bugzilla.redhat.com/2486734","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-38512.html","tags":["advisory"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2026-10879.html","tags":["report"]},{"url":"https://access.redhat.com/errata/RHSA-2026:38513","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-38513.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:38901","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-38901.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:62667","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-10879","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-14380","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-14739","tags":["report"]},{"url":"https://bugzilla.redhat.com/2485464","tags":["report"]},{"url":"https://bugzilla.redhat.com/2497915","tags":["report"]},{"url":"https://bugzilla.redhat.com/2497916","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-62667.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-10879","tags":["advisory"]},{"url":"https://cpan.org/modules","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10879.json","tags":["advisory"]},{"url":"https://github.com/perl5-dbi/dbi","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-10879","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0308.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35643","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/06/06/4","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/06/09/9","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/07/07/16","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/07/07/17","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/07/14/9","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/07/14/13","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/07/14/14","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/07/14/15","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2684","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9698","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2486734","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_38512.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-9698","tags":["advisory"]},{"url":"https://github.com/perl5-dbi/dbi/commit/bfe5d73c162d2d1f761a639a0aa33aad6a9eb54e.patch","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2485464","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-10879","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_38513.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_38901.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2497915","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2497916","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_62667.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-14380","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14380","tags":["advisory"]},{"url":"https://github.com/perl5-dbi/dbi/commit/b73d5d9901767fc1d16b6661ef08fbed4532e259.patch","tags":["article"]},{"url":"https://github.com/perl5-dbi/dbi/security/advisories/GHSA-ch8w-hxc2-v557","tags":["article"]},{"url":"https://metacpan.org/release/HMBRAND/DBI-1.650/changes","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-14739","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14739","tags":["advisory"]},{"url":"https://github.com/perl5-dbi/dbi/commit/2b77c88b655e9539a592c71a61fb965fc0075395.patch","tags":["article"]},{"url":"https://errata.rockylinux.org/RLSA-2026:62667","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622257-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1267849","tags":["report"]},{"url":"https://bugzilla.suse.com/1267957","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-10879","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-9698","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622330-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262749-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-10879","tags":["report"]},{"url":"https://lists.security.metacpan.org/cve-announce/msg/40729086/","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8466-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-9698","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-10879","title":"DBI versions before 1.648 for Perl have a heap overflow when preparsing SQL statements with more than 9 binders","description":"DBI versions before 1.648 for Perl have a heap overflow when preparsing SQL statements with more than 9 binders.\n\nThe preparse method expands SQL placeholder characters to numbered binders of the form :pN, but only allocates three characters per binder in the buffer.  Placeholders 10-99 require four characters, 100-999 require five characters, et cetera.","status":"published","published":"2026-06-05T14:30:58.497Z","modified":"2026-06-08T16:55:27.339Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T13:40:12.486331Z"}],"euvd":[{"id":"EUVD-2026-34843","description":"DBI versions before 1.648 for Perl have a heap overflow when preparsing SQL statements with more than 9 binders.\n\nThe preparse method expands SQL placeholder characters to numbered binders of the form :pN, but only allocates three characters per binder in the buffer.  Placeholders 10-99 require four characters, 100-999 require five characters, et cetera.","status":"published","published":"2026-06-05T14:30:58Z","modified":"2026-06-08T16:55:27Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T18:20:48.834104Z"}],"ghsa":[{"id":"GHSA-c7xw-cj86-m724","title":"DBI versions before 1.648 for Perl have a heap overflow when preparsing SQL statements with more...","description":"DBI versions before 1.648 for Perl have a heap overflow when preparsing SQL statements with more than 9 binders.\n\nThe preparse method expands SQL placeholder characters to numbered binders of the form :pN, but only allocates three characters per binder in the buffer.  Placeholders 10-99 require four characters, 100-999 require five characters, et cetera.","status":"published","published":"2026-06-05T15:32:25Z","modified":"2026-06-08T18:32:46Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T15:08:39.337223Z"}],"nvd":[{"id":"CVE-2026-10879","description":"DBI versions before 1.648 for Perl have a heap overflow when preparsing SQL statements with more than 9 binders.\n\nThe preparse method expands SQL placeholder characters to numbered binders of the form :pN, but only allocates three characters per binder in the buffer.  Placeholders 10-99 require four characters, 100-999 require five characters, et cetera.","status":"published","published":"2026-06-05T15:16:46.817Z","modified":"2026-10-26T11:10:00.157Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:12:22.371367Z"}],"osv":[{"id":"ALPINE-CVE-2026-10879","description":"DBI versions before 1.648 for Perl have a heap overflow when preparsing SQL statements with more than 9 binders.\n\nThe preparse method expands SQL placeholder characters to numbered binders of the form :pN, but only allocates three characters per binder in the buffer.  Placeholders 10-99 require four characters, 100-999 require five characters, et cetera.","status":"published","published":"2026-06-05T15:16:46.817Z","modified":"2026-10-01T02:17:49.169063054Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:27:50.269992Z"},{"id":"BELL-CVE-2026-10879","status":"published","published":"2026-06-11T06:11:56.624157Z","modified":"2026-06-17T07:15:05.968619484Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:23.037038Z"},{"id":"CVE-2026-10879","title":"DBI versions before 1.648 for Perl have a heap overflow when preparsing SQL statements with more than 9 binders","description":"DBI versions before 1.648 for Perl have a heap overflow when preparsing SQL statements with more than 9 binders.\n\nThe preparse method expands SQL placeholder characters to numbered binders of the form :pN, but only allocates three characters per binder in the buffer.  Placeholders 10-99 require four characters, 100-999 require five characters, et cetera.","status":"published","published":"2026-06-05T14:30:58.497Z","modified":"2026-10-29T11:42:21.67482912Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T15:44:55.279797Z"},{"id":"DEBIAN-CVE-2026-10879","description":"DBI versions before 1.648 for Perl have a heap overflow when preparsing SQL statements with more than 9 binders.  The preparse method expands SQL placeholder characters to numbered binders of the form :pN, but only allocates three characters per binder in the buffer.  Placeholders 10-99 require four characters, 100-999 require five characters, et cetera.","status":"published","published":"2026-06-05T15:16:46.817Z","modified":"2026-10-27T09:47:36.45380036Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:49.381767Z"},{"id":"OESA-2026-2684","title":"perl-DBI security update","description":"The DBI is the standard database interface module for Perl. It defines a set of methods, variables and conventions that provide a consistent database interface independent of the actual database being used. It is important to remember that the DBI is just an interface. The DBI is a layer of \u0026amp;quot;glue\u0026amp;quot; between an application and one or more database driver modules. It is the driver modules which do most of the real work. The DBI provides a standard interface and framework for the drivers to operate within.\r\n\r\nSecurity Fix(es):\n\nDBI versions before 1.648 for Perl have a heap overflow when preparsing SQL statements with more than 9 binders.\n\nThe preparse method expands SQL placeholder characters to numbered binders of the form :pN, but only allocates three characters per binder in the buffer.  Placeholders 10-99 require four characters, 100-999 require five characters, et cetera.(CVE-2026-10879)\n\nDBI versions before 1.648 for Perl saved errors in a limited-sized buffer.\n\nError messages that were returned when RaiseError, PrintError or HandleError were set were written to a 200-byte buffer without a length limit.\n\nAttackers that can influence the error text in an application can trigger a buffer overflow.(CVE-2026-9698)","status":"published","published":"2026-06-12T11:11:37Z","modified":"2026-08-18T01:20:05.744668961Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"RHSA-2026:38512","title":"Red Hat Security Advisory: perl-DBI security update","status":"published","published":"2026-07-14T10:09:08Z","modified":"2026-10-17T10:13:17Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.491441Z"},{"id":"RHSA-2026:38513","title":"Red Hat Security Advisory: perl-DBI security update","status":"published","published":"2026-07-13T10:07:46Z","modified":"2026-10-17T10:13:18Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.491441Z"},{"id":"RHSA-2026:38901","title":"Red Hat Security Advisory: perl-DBI:1.641 security update","status":"published","published":"2026-07-14T10:09:17Z","modified":"2026-10-17T10:13:22Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.491441Z"},{"id":"RHSA-2026:62667","title":"Red Hat Security Advisory: perl-DBI security update","status":"published","published":"2026-09-03T10:14:37Z","modified":"2026-10-17T10:17:02Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RLSA-2026:62667","title":"Important: perl-DBI security update","description":"DBI is a database access Application Programming Interface (API) for the Perl Language. The DBI API Specification defines a set of functions, variables and conventions that provide a consistent database interface independent of the actual database being used.\n\nSecurity Fix(es):\n\n* perl-DBI: perl-DBI: Heap overflow in SQL preparsing can lead to denial of service or arbitrary code execution. (CVE-2026-10879)\n\n* DBI: DBI: Buffer overflow in error handling can lead to arbitrary code execution (CVE-2026-9698)\n\n* DBI: DBI: Arbitrary code execution via caller-influenced Profile attribute (CVE-2026-14380)\n\n* DBI: DBI: Heap overflow when preparsing SQL statements with excessive placeholders (CVE-2026-14739)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-09-03T06:01:10.495196Z","modified":"2026-09-03T06:30:02.111983915Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"UBUNTU-CVE-2026-10879","description":"DBI versions before 1.648 for Perl have a heap overflow when preparsing SQL statements with more than 9 binders. The preparse method expands SQL placeholder characters to numbered binders of the form :pN, but only allocates three characters per binder in the buffer.  Placeholders 10-99 require four characters, 100-999 require five characters, et cetera.","status":"published","published":"2026-06-05T15:16:00Z","modified":"2026-06-25T00:15:12.48155426Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:55:59.130573Z"},{"id":"ALSA-2026:38512","title":"Important: perl-DBI security update","description":"DBI is a database access Application Programming Interface (API) for the Perl Language. The DBI API Specification defines a set of functions, variables and conventions that provide a consistent database interface independent of the actual database being used.  \n\nSecurity Fix(es):  \n\n  * DBI: DBI: Buffer overflow in error handling can lead to arbitrary code execution (CVE-2026-9698)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-07-13T00:00:00Z","modified":"2026-10-29T11:42:25.093537563Z","updated_at":"2026-11-02T15:27:54.283654Z"},{"id":"ALSA-2026:38513","title":"Important: perl-DBI security update","description":"DBI is a database access Application Programming Interface (API) for the Perl Language. The DBI API Specification defines a set of functions, variables and conventions that provide a consistent database interface independent of the actual database being used.  \n\nSecurity Fix(es):  \n\n  * DBI: DBI: Buffer overflow in error handling can lead to arbitrary code execution (CVE-2026-9698)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-07-13T00:00:00Z","modified":"2026-10-29T11:42:24.637723696Z","updated_at":"2026-11-02T15:27:54.283654Z"},{"id":"ALSA-2026:38901","title":"Important: perl-DBI:1.641 security update","description":"The perl-DBI package provides the standard database interface module for the Perl programming language. It implements a database-independent interface, meaning it defines a consistent set of methods, variables, and conventions for database operations.  \n\nSecurity Fix(es):  \n\n  * DBI: DBI: Buffer overflow in error handling can lead to arbitrary code execution (CVE-2026-9698)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-07-13T00:00:00Z","modified":"2026-10-29T11:12:05.076016667Z","updated_at":"2026-11-02T15:27:54.283654Z"},{"id":"ALSA-2026:62667","title":"Important: perl-DBI security update","description":"DBI is a database access Application Programming Interface (API) for the Perl Language. The DBI API Specification defines a set of functions, variables and conventions that provide a consistent database interface independent of the actual database being used.  \n\nSecurity Fix(es):  \n\n  * perl-DBI: perl-DBI: Heap overflow in SQL preparsing can lead to denial of service or arbitrary code execution. (CVE-2026-10879)\n  * DBI: DBI: Buffer overflow in error handling can lead to arbitrary code execution (CVE-2026-9698)\n  * DBI: DBI: Arbitrary code execution via caller-influenced Profile attribute (CVE-2026-14380)\n  * DBI: DBI: Heap overflow when preparsing SQL statements with excessive placeholders (CVE-2026-14739)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-09-02T00:00:00Z","modified":"2026-10-29T11:02:29.067490244Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"AZL-89559","title":"CVE-2026-10879 affecting package perl-DBI for versions less than 1.643-5","description":"DBI versions before 1.648 for Perl have a heap overflow when preparsing SQL statements with more than 9 binders.\n\nThe preparse method expands SQL placeholder characters to numbered binders of the form :pN, but only allocates three characters per binder in the buffer.  Placeholders 10-99 require four characters, 100-999 require five characters, et cetera.","status":"published","published":"2026-06-05T15:16:46Z","modified":"2026-08-28T17:56:32.297784Z","updated_at":"2026-11-02T15:28:11.397546Z"},{"id":"MGASA-2026-0308","title":"Updated perl-DBI packages fix security vulnerabilities","description":"The updated packages fix several security issues.\n","status":"published","published":"2026-07-30T17:03:15Z","modified":"2026-07-30T17:20:27.407974876Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:10986-1","title":"perl-DBI-1.648.0-1.1 on GA media","description":"These are all security issues fixed in the perl-DBI-1.648.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-06-09T00:00:00Z","modified":"2026-06-10T18:24:13.937985517Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:21029-1","title":"Security update for perl-DBI","description":"This update for perl-DBI fixes the following issues\n\n- CVE-2026-9698: DBI versions before 1.648 for Perl saved errors in a limited-sized buffer (bsc#1267957).\n- CVE-2026-10879: SQL statements with more than 9 binders can cause an heap overflow (bsc#1267849).\n","status":"published","published":"2026-06-22T14:30:38Z","modified":"2026-06-30T18:24:28.755152186Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:22257-1","title":"Security update for perl-DBI","description":"This update for perl-DBI fixes the following issues\n\n- CVE-2026-9698: DBI versions before 1.648 for Perl saved errors in a limited-sized buffer (bsc#1267957).\n- CVE-2026-10879: SQL statements with more than 9 binders can cause an heap overflow (bsc#1267849).\n","status":"published","published":"2026-06-22T14:28:57Z","modified":"2026-06-30T18:24:31.98617295Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:22330-1","title":"Security update for perl-DBI","description":"This update for perl-DBI fixes the following issues\n\n- CVE-2026-9698: DBI versions before 1.648 for Perl saved errors in a limited-sized buffer (bsc#1267957).\n- CVE-2026-10879: SQL statements with more than 9 binders can cause an heap overflow (bsc#1267849).\n","status":"published","published":"2026-06-22T14:28:57Z","modified":"2026-07-02T18:24:11.11877312Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:2749-1","title":"Security update for perl-DBI","description":"This update for perl-DBI fixes the following issues\n\n- CVE-2026-9698: DBI versions before 1.648 for Perl saved errors in a limited-sized buffer (bsc#1267957).\n- CVE-2026-10879: SQL statements with more than 9 binders can cause an heap overflow (bsc#1267849).\n","status":"published","published":"2026-07-03T13:04:49Z","modified":"2026-07-04T08:30:06.179271346Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"USN-8466-1","title":"libdbi-perl vulnerabilities","description":"It was discovered that the Perl DBI module incorrectly handled certain\nerror messages. An attacker could use this issue to cause applications\nusing the Perl DBI module to crash, resulting in a denial of service, or\npossibly execute arbitrary code. (CVE-2026-9698)\n\nIt was discovered that the Perl DBI module incorrectly handled memory when\npreparsing SQL statements that included more than nine binders. An attacker\ncould use this issue to cause applications using the Perl DBI module to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode. (CVE-2026-10879)","status":"published","published":"2026-06-24T09:30:53Z","modified":"2026-06-30T18:17:36.572426542Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}