{"id":"CVE-2026-3257","aliases":["EUVD-2026-9519","GHSA-4rjc-gpxw-9fr5"],"status":"published","title":"UnQLite versions through 0.06 for Perl uses a potentially insecure version of the UnQLite library","description":"UnQLite versions through 0.06 for Perl uses a potentially insecure version of the UnQLite library.\n\nUnQLite for Perl embeds the UnQLite library.  Version 0.06 and earlier of the Perl module uses a version of the library from 2014 that may be vulnerable to a heap-based overflow.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00464,"percentile":0.40472,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-1395"],"published":"2026-03-05T01:35:12Z","modified":"2026-10-28T02:30:57Z","products":[{"vendor":"tokuhirom","product":"unqlite"}],"references":[{"url":"https://metacpan.org/release/TOKUHIROM/UnQLite-0.07/source/Changes","tags":["release-notes","Release Notes","advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-3791","tags":["vendor-advisory","related","vdb-entry","Third Party Advisory","advisory"]},{"url":"https://unqlite.symisc.net/","tags":["Product","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-3257","tags":["advisory"]},{"url":"https://unqlite.symisc.net"},{"url":"https://github.com/advisories/GHSA-4rjc-gpxw-9fr5"},{"url":"https://cpan.org/modules","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/3xxx/CVE-2026-3257.json","tags":["advisory"]},{"url":"https://github.com/tokuhirom/UnQLite","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-3257","title":"UnQLite versions through 0.06 for Perl uses a potentially insecure version of the UnQLite library","description":"UnQLite versions through 0.06 for Perl uses a potentially insecure version of the UnQLite library.\n\nUnQLite for Perl embeds the UnQLite library.  Version 0.06 and earlier of the Perl module uses a version of the library from 2014 that may be vulnerable to a heap-based overflow.","status":"published","published":"2026-03-05T01:35:12.789Z","modified":"2026-03-05T16:34:39.834Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-1395"],"updated_at":"2026-11-02T13:48:58.05327Z"}],"euvd":[{"id":"EUVD-2026-9519","description":"UnQLite versions through 0.06 for Perl uses a potentially insecure version of the UnQLite library.\n\nUnQLite for Perl embeds the UnQLite library.  Version 0.06 and earlier of the Perl module uses a version of the library from 2014 that may be vulnerable to a heap-based overflow.","status":"published","published":"2026-03-05T01:35:12Z","modified":"2026-03-05T16:34:39Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T19:48:08.87511Z"}],"ghsa":[{"id":"GHSA-4rjc-gpxw-9fr5","title":"UnQLite versions through 0.06 for Perl uses a potentially insecure version of the UnQLite library...","description":"UnQLite versions through 0.06 for Perl uses a potentially insecure version of the UnQLite library.\n\nUnQLite for Perl embeds the UnQLite library.  Version 0.06 and earlier of the Perl module uses a version of the library from 2014 that may be vulnerable to a heap-based overflow.","status":"published","published":"2026-03-05T03:31:26Z","modified":"2026-03-05T21:30:38Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:06:28.064128Z"}],"nvd":[{"id":"CVE-2026-3257","description":"UnQLite versions through 0.06 for Perl uses a potentially insecure version of the UnQLite library.\n\nUnQLite for Perl embeds the UnQLite library.  Version 0.06 and earlier of the Perl module uses a version of the library from 2014 that may be vulnerable to a heap-based overflow.","status":"published","published":"2026-03-05T02:16:52.15Z","modified":"2026-06-17T10:43:17.317Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"updated_at":"2026-11-02T14:12:07.852448Z"}],"osv":[{"id":"CVE-2026-3257","title":"UnQLite versions through 0.06 for Perl uses a potentially insecure version of the UnQLite library","description":"UnQLite versions through 0.06 for Perl uses a potentially insecure version of the UnQLite library.\n\nUnQLite for Perl embeds the UnQLite library.  Version 0.06 and earlier of the Perl module uses a version of the library from 2014 that may be vulnerable to a heap-based overflow.","status":"published","published":"2026-03-05T01:35:12.789Z","modified":"2026-10-28T02:30:57.002106739Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-1395"],"updated_at":"2026-11-02T15:45:01.548715Z"}]}}