{"id":"CVE-2026-14739","aliases":["ALPINE-CVE-2026-14739","ALSA-2026:49514","ALSA-2026:49612","ALSA-2026:52772","ALSA-2026:62667","AZL-92202","BELL-CVE-2026-14739","CLSA-2026-1786120315","CLSA-2026-1786121082","DEBIAN-CVE-2026-14739","EUVD-2026-42124","GHSA-w9gf-c5hh-cc8w","MGASA-2026-0308","OESA-2026-3183","RHSA-2026:49514","RHSA-2026:49612","RHSA-2026:52772","RHSA-2026:62667","RLSA-2026:49514","RLSA-2026:49612","RLSA-2026:52772","RLSA-2026:62667","ROOT-OS-DEBIAN-12-CVE-2026-14739","UBUNTU-CVE-2026-14739","openSUSE-SU-2026:11234-1"],"status":"published","title":"DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders","description":"DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders.\n\nThe fix for CVE-2026-10879 did not allocate enough memory to handle approximately 1.2-million placeholders.\n\nDBI version 1.650 sets a hard limit of 99,999 placeholders.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00413,"percentile":0.35872,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2026-07-07T22:05:18Z","modified":"2026-10-29T11:32:23Z","fixes":[{"ecosystem":"Alpine:v3.24","package":"perl-dbi","fixed_in":["1.651-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"perl-DBI","fixed_in":["1.650-1"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"perl-dbi","fixed_in":["1.651-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"perl-dbi","fixed_in":["1.651-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"perl-dbi","fixed_in":["1.650-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libdbi-perl","fixed_in":["1.643-4+deb12u2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libdbi-perl","fixed_in":["1.652-2~deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libdbi-perl","fixed_in":["1.650-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.24","package":"perl-dbi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.651-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.643-26.el10_2.3"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.643-9.el9_8.3"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.641-8.module_el8.10.0+4245+6005333d"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.641-2.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Azure Linux:3","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.650-1"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"perl-dbi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.643-r4"},{"fixed":"1.651-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"perl-dbi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.647-r0"},{"fixed":"1.651-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"perl-dbi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.643-r3"},{"fixed":"1.650-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.643-9.el9_2.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.643-9.el9_6.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.643-4+deb12u2"}]}],"versions":["1.643-4","1.643-4+deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.652-2~deb13u1"}]}],"versions":["1.647-1","1.647-1+deb13u1","1.648-1","1.649-1","1.650-1","1.651-1","1.652-1"]},{"source":"osv","ecosystem":"Debian:14","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.650-1"}]}],"versions":["1.647-1","1.648-1","1.649-1"]},{"source":"osv","ecosystem":"Mageia:10","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.651.0-1.mga10"}]}],"bundled":9},{"source":"osv","ecosystem":"Mageia:9","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.651.0-1.mga9"}]}],"bundled":9},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.643-6.oe2203sp4"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.643-6.oe2403sp1"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.643-6.oe2403sp3"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.648-2.oe2403sp4"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.643-5.oe2003sp4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.643-26.el10_2.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"perl-DBI-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.643-26.el10_2.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"perl-DBI-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.643-26.el10_2.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.643-9.el9_8.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"perl-DBI-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.643-9.el9_8.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"perl-DBI-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.643-9.el9_8.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.641-8.module+el8.10.0+24620+ff0e05e9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"perl-DBI-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.641-8.module+el8.10.0+24620+ff0e05e9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"perl-DBI-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.641-8.module+el8.10.0+24620+ff0e05e9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.641-2.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"perl-DBI-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.641-2.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"perl-DBI-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.641-2.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:10","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.643-26.el10_2.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.643-9.el9_8.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.641-8.module+el8.10.0+40273+66ce089d"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.641-8.module+el8.10.0+40273+4d327a6c"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.641-8.module+el8.10.0+40273+d479100a"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.641-8.module+el8.10.0+40273+0bbde87c"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.641-2.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.627-1","1.628-1","1.630-1","1.630-1ubuntu0.1~esm1","1.630-1ubuntu0.1~esm4","1.630-1ubuntu0.1~esm5","1.630-1ubuntu0.1~esm6","1.630-1ubuntu0.1~esm8","1.630-1ubuntu0.1~esm9"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.633-1","1.634-1","1.634-1build1","1.634-1ubuntu0.1","1.634-1ubuntu0.2","1.634-1ubuntu0.2+esm1","1.634-1ubuntu0.2+esm2","1.634-1ubuntu0.2+esm4","1.634-1ubuntu0.2+esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.637-1","1.639-1","1.640-1","1.640-1ubuntu0.1","1.640-1ubuntu0.2","1.640-1ubuntu0.3","1.640-1ubuntu0.3+esm1","1.640-1ubuntu0.3+esm3","1.640-1ubuntu0.3+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.642-1","1.642-1build1","1.643-1","1.643-1ubuntu0.1","1.643-1ubuntu0.1+esm1","1.643-1ubuntu0.1+esm3","1.643-1ubuntu0.1+esm4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.643-3build2","1.643-3build3","1.643-3ubuntu0.1","1.643-3ubuntu0.3","1.643-3ubuntu0.4"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.643-4","1.643-4build1","1.643-4build2","1.643-4build3","1.643-4ubuntu0.1","1.643-4ubuntu0.3","1.643-4ubuntu0.4"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.647-1","1.647-1ubuntu0.25.10.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.647-1build1","1.648-1","1.651-1","1.652-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.647-1","1.647-1build1","1.647-1ubuntu0.26.04.1","1.647-1ubuntu0.26.04.3","1.647-1ubuntu0.26.04.4"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.650.0-1.1"}]}],"bundled":3}],"products":[{"vendor":"hmbrand","product":"dbi"},{"vendor":"perl","product":"dbi"}],"references":[{"url":"https://github.com/perl5-dbi/dbi/commit/2b77c88b655e9539a592c71a61fb965fc0075395.patch","tags":["patch","Patch","fix","article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-10879","tags":["vendor-advisory","related","Not Applicable","advisory"]},{"url":"https://metacpan.org/release/HMBRAND/DBI-1.650/changes","tags":["release-notes","Release Notes","advisory","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14739","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-w9gf-c5hh-cc8w"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-14739","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:49514","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-14380","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-14739","tags":["report"]},{"url":"https://bugzilla.redhat.com/2497915","tags":["report"]},{"url":"https://bugzilla.redhat.com/2497916","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-49514.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:49612","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-49612.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:52772","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-52772.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:62667","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-10879","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-9698","tags":["report"]},{"url":"https://bugzilla.redhat.com/2485464","tags":["report"]},{"url":"https://bugzilla.redhat.com/2486734","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-62667.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-14739","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1786120315.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14380","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1786121082.html","tags":["advisory"]},{"url":"https://cpan.org/modules","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/14xxx/CVE-2026-14739.json","tags":["advisory"]},{"url":"https://github.com/perl5-dbi/dbi","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-14739","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0308.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35643","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/06/06/4","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/06/09/9","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/07/07/16","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/07/07/17","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/07/14/9","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/07/14/13","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/07/14/14","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/07/14/15","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3183","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15043","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-60081","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-60082","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2497915","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2497916","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_49514.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-14380","tags":["advisory"]},{"url":"https://github.com/perl5-dbi/dbi/commit/b73d5d9901767fc1d16b6661ef08fbed4532e259.patch","tags":["article"]},{"url":"https://github.com/perl5-dbi/dbi/security/advisories/GHSA-ch8w-hxc2-v557","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-14739","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_49612.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_52772.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2485464","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2486734","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_62667.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-9698","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9698","tags":["advisory"]},{"url":"https://github.com/perl5-dbi/dbi/commit/bfe5d73c162d2d1f761a639a0aa33aad6a9eb54e.patch","tags":["article"]},{"url":"https://metacpan.org/release/HMBRAND/DBI-1.648/changes","tags":["article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10879","tags":["advisory"]},{"url":"https://github.com/perl5-dbi/dbi/commit/af79036c07aa9a457971c0f4136e37c85dc20978.patch","tags":["article"]},{"url":"https://errata.rockylinux.org/RLSA-2026:49514","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:49612","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:52772","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:62667","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-14739","tags":["report"]},{"url":"https://lists.security.metacpan.org/cve-announce/msg/41625530/","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-14380","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-14739","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-14740","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-14739","title":"DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders","description":"DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders.\n\nThe fix for CVE-2026-10879 did not allocate enough memory to handle approximately 1.2-million placeholders.\n\nDBI version 1.650 sets a hard limit of 99,999 placeholders.","status":"published","published":"2026-07-07T22:05:18.457Z","modified":"2026-07-08T13:56:43.597Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T13:38:32.13011Z"}],"euvd":[{"id":"EUVD-2026-42124","description":"DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders.\n\nThe fix for CVE-2026-10879 did not allocate enough memory to handle approximately 1.2-million placeholders.\n\nDBI version 1.650 sets a hard limit of 99,999 placeholders.","status":"published","published":"2026-07-07T22:05:18Z","modified":"2026-07-08T13:56:43Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T18:20:10.578977Z"}],"ghsa":[{"id":"GHSA-w9gf-c5hh-cc8w","title":"DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an...","description":"DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders.\n\nThe fix for CVE-2026-10879 did not allocate enough memory to handle approximately 1.2-million placeholders.\n\nDBI version 1.650 sets a hard limit of 99,999 placeholders.","status":"published","published":"2026-07-08T00:37:55Z","modified":"2026-07-08T15:31:55Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T15:09:19.587132Z"}],"nvd":[{"id":"CVE-2026-14739","description":"DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders.\n\nThe fix for CVE-2026-10879 did not allocate enough memory to handle approximately 1.2-million placeholders.\n\nDBI version 1.650 sets a hard limit of 99,999 placeholders.","status":"published","published":"2026-07-07T23:16:54.09Z","modified":"2026-10-25T20:10:00.147Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:12:28.040501Z"}],"osv":[{"id":"ALPINE-CVE-2026-14739","description":"DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders.\n\nThe fix for CVE-2026-10879 did not allocate enough memory to handle approximately 1.2-million placeholders.\n\nDBI version 1.650 sets a hard limit of 99,999 placeholders.","status":"published","published":"2026-07-07T23:16:54.09Z","modified":"2026-10-01T02:17:49.188950685Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:27:50.269992Z"},{"id":"BELL-CVE-2026-14739","status":"published","published":"2026-07-09T06:03:09.992676Z","modified":"2026-07-24T07:15:06.068852327Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:23.037038Z"},{"id":"CVE-2026-14739","title":"DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders","description":"DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders.\n\nThe fix for CVE-2026-10879 did not allocate enough memory to handle approximately 1.2-million placeholders.\n\nDBI version 1.650 sets a hard limit of 99,999 placeholders.","status":"published","published":"2026-07-07T22:05:18.457Z","modified":"2026-10-28T02:30:28.163203109Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T15:44:57.682091Z"},{"id":"DEBIAN-CVE-2026-14739","description":"DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders.  The fix for CVE-2026-10879 did not allocate enough memory to handle approximately 1.2-million placeholders.  DBI version 1.650 sets a hard limit of 99,999 placeholders.","status":"published","published":"2026-07-07T23:16:54.09Z","modified":"2026-10-26T11:47:23.905421782Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:51.8748Z"},{"id":"OESA-2026-3183","title":"perl-DBI security update","description":"The DBI is the standard database interface module for Perl. It defines a set of methods, variables and conventions that provide a consistent database interface independent of the actual database being used. It is important to remember that the DBI is just an interface. The DBI is a layer of \u0026amp;quot;glue\u0026amp;quot; between an application and one or more database driver modules. It is the driver modules which do most of the real work. The DBI provides a standard interface and framework for the drivers to operate within.\r\n\r\nSecurity Fix(es):\n\nDBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders.\n\nThe fix for CVE-2026-10879 did not allocate enough memory to handle approximately 1.2-million placeholders.\n\nDBI version 1.650 sets a hard limit of 99,999 placeholders.(CVE-2026-14739)\n\nDBI::SQL::Nano versions from 1.42 before 1.651 for Perl have inverted \u0026lt;= and \u0026gt;= SQL operators on text.\n\nDBI::SQL::Nano, DBI\u0026apos;s built-in mini-SQL engine, evaluated WHERE predicates incorrectly in some cases. In the non-numeric string branch of the is_matched method, \u0026lt;= was evaluated using Perl\u0026apos;s ge operator, and \u0026gt;= was evaluated using Perl\u0026apos;s le operator.\n\nSQL::Nano is the fallback query engine for DBI\u0026apos;s file-backed drivers (DBD::File, DBD::DBM, CSV-style drivers) whenever SQL::Statement is not installed, and is forced whenever DBI_SQL_NANO=1. Queries over such tables use these predicates directly.\n\nThe impact depends on the context. Where an application relies on a WHERE clause to filter file-backed data for policy or authorization, an inverted \u0026lt;=/\u0026gt;= comparison silently returns the wrong rows.(CVE-2026-15043)\n\nDBI::ProfileData versions before 1.651 for Perl do not limit the path index.\n\nThe path index column of profile dump files is used to allocate an array of data for the parser. An unbounded value allows an attacker to specify a large index and consume available memory.(CVE-2026-60081)\n\nDBI versions before 1.651 for Perl do not enforce statement handle consistency with the row.\n\nWhen the statement handle had no fields but the source row was non-empty, the internal row-buffer helper would read from a negative array index.\n\nThis could be triggered by a caller supplying inconsistent metadata and rows to the prepare method.(CVE-2026-60082)","status":"published","published":"2026-07-24T11:12:03Z","modified":"2026-08-18T01:21:24.868996573Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"RHSA-2026:49514","title":"Red Hat Security Advisory: perl-DBI security update","status":"published","published":"2026-08-03T10:17:38Z","modified":"2026-09-03T10:11:13Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:49612","title":"Red Hat Security Advisory: perl-DBI security update","status":"published","published":"2026-08-04T10:26:54Z","modified":"2026-09-03T10:11:15Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:52772","title":"Red Hat Security Advisory: perl-DBI:1.641 security update","status":"published","published":"2026-08-11T10:12:00Z","modified":"2026-09-03T10:11:50Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:62667","title":"Red Hat Security Advisory: perl-DBI security update","status":"published","published":"2026-09-03T10:14:37Z","modified":"2026-10-17T10:17:02Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RLSA-2026:49514","title":"Important: perl-DBI security update","description":"DBI is a database access Application Programming Interface (API) for the Perl Language. The DBI API Specification defines a set of functions, variables and conventions that provide a consistent database interface independent of the actual database being used.\n\nSecurity Fix(es):\n\n* DBI: DBI: Arbitrary code execution via caller-influenced Profile attribute (CVE-2026-14380)\n\n* DBI: DBI: Heap overflow when preparsing SQL statements with excessive placeholders (CVE-2026-14739)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-08-04T12:06:38.550879Z","modified":"2026-08-04T12:30:05.721273352Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"RLSA-2026:49612","title":"Important: perl-DBI security update","description":"DBI is a database access Application Programming Interface (API) for the Perl Language. The DBI API Specification defines a set of functions, variables and conventions that provide a consistent database interface independent of the actual database being used.\n\nSecurity Fix(es):\n\n* DBI: DBI: Arbitrary code execution via caller-influenced Profile attribute (CVE-2026-14380)\n\n* DBI: DBI: Heap overflow when preparsing SQL statements with excessive placeholders (CVE-2026-14739)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-08-04T12:03:54.895769Z","modified":"2026-08-04T12:30:06.963446917Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"RLSA-2026:52772","title":"Important: perl-DBI:1.641 security update","description":"The perl-DBI package provides the standard database interface module for the\nPerl programming language. It implements a database-independent interface,\nmeaning it defines a consistent set of methods, variables, and conventions for\ndatabase operations.\n\nSecurity Fix(es):\n\n* DBI: Heap overflow when preparsing SQL statements with excessive placeholders (CVE-2026-14739)\n\n* DBI: Arbitrary code execution via caller-influenced Profile attribute (CVE-2026-14380)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-08-11T06:01:05.009678Z","modified":"2026-08-11T06:30:07.96972661Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"RLSA-2026:62667","title":"Important: perl-DBI security update","description":"DBI is a database access Application Programming Interface (API) for the Perl Language. The DBI API Specification defines a set of functions, variables and conventions that provide a consistent database interface independent of the actual database being used.\n\nSecurity Fix(es):\n\n* perl-DBI: perl-DBI: Heap overflow in SQL preparsing can lead to denial of service or arbitrary code execution. (CVE-2026-10879)\n\n* DBI: DBI: Buffer overflow in error handling can lead to arbitrary code execution (CVE-2026-9698)\n\n* DBI: DBI: Arbitrary code execution via caller-influenced Profile attribute (CVE-2026-14380)\n\n* DBI: DBI: Heap overflow when preparsing SQL statements with excessive placeholders (CVE-2026-14739)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-09-03T06:01:10.495196Z","modified":"2026-09-03T06:30:02.111983915Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"UBUNTU-CVE-2026-14739","description":"DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders. The fix for CVE-2026-10879 did not allocate enough memory to handle approximately 1.2-million placeholders. DBI version 1.650 sets a hard limit of 99,999 placeholders.","status":"published","published":"2026-07-07T23:16:00Z","modified":"2026-10-17T12:59:52.77644263Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:56:00.592716Z"},{"id":"ALSA-2026:49514","title":"Important: perl-DBI security update","description":"DBI is a database access Application Programming Interface (API) for the Perl Language. The DBI API Specification defines a set of functions, variables and conventions that provide a consistent database interface independent of the actual database being used.  \n\nSecurity Fix(es):  \n\n  * DBI: DBI: Arbitrary code execution via caller-influenced Profile attribute (CVE-2026-14380)\n  * DBI: DBI: Heap overflow when preparsing SQL statements with excessive placeholders (CVE-2026-14739)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-08-03T00:00:00Z","modified":"2026-10-29T11:30:33.74502356Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"ALSA-2026:49612","title":"Important: perl-DBI security update","description":"DBI is a database access Application Programming Interface (API) for the Perl Language. The DBI API Specification defines a set of functions, variables and conventions that provide a consistent database interface independent of the actual database being used.  \n\nSecurity Fix(es):  \n\n  * DBI: DBI: Arbitrary code execution via caller-influenced Profile attribute (CVE-2026-14380)\n  * DBI: DBI: Heap overflow when preparsing SQL statements with excessive placeholders (CVE-2026-14739)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-08-03T00:00:00Z","modified":"2026-10-29T11:32:23.534777542Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"ALSA-2026:52772","title":"Important: perl-DBI:1.641 security update","description":"The perl-DBI package provides the standard database interface module for the  \nPerl programming language. It implements a database-independent interface,  \nmeaning it defines a consistent set of methods, variables, and conventions for  \ndatabase operations.  \n\nSecurity Fix(es):  \n\n  * DBI: Heap overflow when preparsing SQL statements with excessive placeholders (CVE-2026-14739)\n  * DBI: Arbitrary code execution via caller-influenced Profile attribute (CVE-2026-14380)\n\n\nFor more details about the security issue(s), including the impact, a CVSS  \nscore, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-08-10T00:00:00Z","modified":"2026-10-29T11:02:28.877022439Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"ALSA-2026:62667","title":"Important: perl-DBI security update","description":"DBI is a database access Application Programming Interface (API) for the Perl Language. The DBI API Specification defines a set of functions, variables and conventions that provide a consistent database interface independent of the actual database being used.  \n\nSecurity Fix(es):  \n\n  * perl-DBI: perl-DBI: Heap overflow in SQL preparsing can lead to denial of service or arbitrary code execution. (CVE-2026-10879)\n  * DBI: DBI: Buffer overflow in error handling can lead to arbitrary code execution (CVE-2026-9698)\n  * DBI: DBI: Arbitrary code execution via caller-influenced Profile attribute (CVE-2026-14380)\n  * DBI: DBI: Heap overflow when preparsing SQL statements with excessive placeholders (CVE-2026-14739)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-09-02T00:00:00Z","modified":"2026-10-29T11:02:29.067490244Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"AZL-92202","title":"CVE-2026-14739 affecting package perl-DBI for versions less than 1.650-1","description":"DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders.\n\nThe fix for CVE-2026-10879 did not allocate enough memory to handle approximately 1.2-million placeholders.\n\nDBI version 1.650 sets a hard limit of 99,999 placeholders.","status":"published","published":"2026-07-07T23:16:54Z","modified":"2026-08-28T17:56:54.536813Z","updated_at":"2026-11-02T15:28:11.723718Z"},{"id":"CLSA-2026-1786120315","title":"perl-DBI: Fix of 2 CVEs","description":"- CVE-2026-14380: load DBI::Profile packages via Module::Load instead of\n  interpolating the caller-influenced package name into a string eval\n- CVE-2026-14739: set a hard limit of 99999 '?' placeholders and grow the\n  preparse() buffer to 7x the statement length","status":"published","published":"2026-08-07T16:32:07Z","modified":"2026-10-26T09:30:31.210773198Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"CLSA-2026-1786121082","title":"perl-DBI: Fix of 2 CVEs","description":"- CVE-2026-14380: load DBI::Profile packages via Module::Load instead of\n  interpolating the caller-influenced package name into a string eval\n- CVE-2026-14739: set a hard limit of 99999 '?' placeholders and grow the\n  preparse() buffer to 7x the statement length","status":"published","published":"2026-08-07T16:44:54Z","modified":"2026-10-26T09:31:04.133652307Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"MGASA-2026-0308","title":"Updated perl-DBI packages fix security vulnerabilities","description":"The updated packages fix several security issues.\n","status":"published","published":"2026-07-30T17:03:15Z","modified":"2026-07-30T17:20:27.407974876Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11234-1","title":"perl-DBI-1.650.0-1.1 on GA media","description":"These are all security issues fixed in the perl-DBI-1.650.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-09T00:00:00Z","modified":"2026-07-10T10:00:09.100903533Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2026-14739","title":"CVE-2026-14739 in libdbi-perl - Patched by Root","description":"Root has patched CVE-2026-14739 in the libdbi-perl package for Root:Debian:12. Multiple fixed versions available.","status":"withdrawn","published":"2026-09-28T12:42:17Z","modified":"2026-10-09T13:00:12.52923793Z","updated_at":"2026-11-02T15:53:31.773105Z"}]}}