{"id":"CVE-2026-60082","aliases":["ALPINE-CVE-2026-60082","AZL-92421","BELL-CVE-2026-60082","DEBIAN-CVE-2026-60082","EUVD-2026-43729","GHSA-rwhc-hhmv-cjvg","MGASA-2026-0308","OESA-2026-3183","SUSE-SU-2026:22845-1","SUSE-SU-2026:22926-1","SUSE-SU-2026:3283-1","SUSE-SU-2026:3415-1","SUSE-SU-2026:3461-1","UBUNTU-CVE-2026-60082","openSUSE-SU-2026:11298-1","openSUSE-SU-2026:21412-1"],"status":"published","title":"DBI versions before 1.651 for Perl do not enforce statement handle consistency with the row","description":"DBI versions before 1.651 for Perl do not enforce statement handle consistency with the row.\n\nWhen the statement handle had no fields but the source row was non-empty, the internal row-buffer helper would read from a negative array index.\n\nThis could be triggered by a caller supplying inconsistent metadata and rows to the prepare method.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00653,"percentile":0.51645,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2026-07-14T15:35:00Z","modified":"2026-10-28T02:30:54Z","fixes":[{"ecosystem":"Alpine:v3.24","package":"perl-dbi","fixed_in":["1.651-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"perl-DBI","fixed_in":["1.651-1"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"perl-dbi","fixed_in":["1.651-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"perl-dbi","fixed_in":["1.651-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"perl-dbi","fixed_in":["1.651-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libdbi-perl","fixed_in":["1.643-4+deb12u2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libdbi-perl","fixed_in":["1.652-2~deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libdbi-perl","fixed_in":["1.651-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.24","package":"perl-dbi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.651-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.651-1"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"perl-dbi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.643-r4"},{"fixed":"1.651-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"perl-dbi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.647-r0"},{"fixed":"1.651-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"perl-dbi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.643-r3"},{"fixed":"1.651-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.643-4+deb12u2"}]}],"versions":["1.643-4","1.643-4+deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.652-2~deb13u1"}]}],"versions":["1.647-1","1.647-1+deb13u1","1.648-1","1.649-1","1.650-1","1.651-1","1.652-1"]},{"source":"osv","ecosystem":"Debian:14","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.651-1"}]}],"versions":["1.647-1","1.648-1","1.649-1","1.650-1"]},{"source":"osv","ecosystem":"Mageia:10","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.651.0-1.mga10"}]}],"bundled":9},{"source":"osv","ecosystem":"Mageia:9","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.651.0-1.mga9"}]}],"bundled":9},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.643-6.oe2203sp4"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.643-6.oe2403sp1"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.643-6.oe2403sp3"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.648-2.oe2403sp4"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.643-5.oe2003sp4"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.647.0-160000.5.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.647.0-160000.5.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.647.0-160000.5.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.642-150200.3.19.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.642-150200.3.19.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.642-150200.3.19.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.642-150200.3.19.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.642-150200.3.19.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.642-150200.3.19.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.642-150200.3.19.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.642-150200.3.19.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.647.0-150600.12.18.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.647.0-150600.12.18.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.647.0-150600.12.18.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.628-5.21.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.628-5.21.1"}]}],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.627-1","1.628-1","1.630-1","1.630-1ubuntu0.1~esm1","1.630-1ubuntu0.1~esm4","1.630-1ubuntu0.1~esm5","1.630-1ubuntu0.1~esm6","1.630-1ubuntu0.1~esm8","1.630-1ubuntu0.1~esm9"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.633-1","1.634-1","1.634-1build1","1.634-1ubuntu0.1","1.634-1ubuntu0.2","1.634-1ubuntu0.2+esm1","1.634-1ubuntu0.2+esm2","1.634-1ubuntu0.2+esm4","1.634-1ubuntu0.2+esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.637-1","1.639-1","1.640-1","1.640-1ubuntu0.1","1.640-1ubuntu0.2","1.640-1ubuntu0.3","1.640-1ubuntu0.3+esm1","1.640-1ubuntu0.3+esm3","1.640-1ubuntu0.3+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.642-1","1.642-1build1","1.643-1","1.643-1ubuntu0.1","1.643-1ubuntu0.1+esm1","1.643-1ubuntu0.1+esm3","1.643-1ubuntu0.1+esm4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.643-3build2","1.643-3build3","1.643-3ubuntu0.1","1.643-3ubuntu0.3","1.643-3ubuntu0.4"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.643-4","1.643-4build1","1.643-4build2","1.643-4build3","1.643-4ubuntu0.1","1.643-4ubuntu0.3","1.643-4ubuntu0.4"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.647-1build1","1.648-1","1.651-1","1.652-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.647-1","1.647-1build1","1.647-1ubuntu0.26.04.1","1.647-1ubuntu0.26.04.3","1.647-1ubuntu0.26.04.4"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.651.0-1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.647.0-160000.5.1"}]}],"bundled":4}],"products":[{"vendor":"hmbrand","product":"dbi"}],"references":[{"url":"https://github.com/perl5-dbi/dbi/security/advisories/GHSA-rwhc-hhmv-cjvg","tags":["vendor-advisory","advisory","report"]},{"url":"https://metacpan.org/release/HMBRAND/DBI-1.651/changes","tags":["release-notes","advisory","report"]},{"url":"https://github.com/perl5-dbi/dbi/commit/397868704291bbf0989b97e2c0661189890653e2.patch","tags":["patch","fix","report"]},{"url":"http://www.openwall.com/lists/oss-security/2026/07/14/13","tags":["web","report"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-60082","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-60082","tags":["web","advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-60082","tags":["advisory"]},{"url":"https://cpan.org/modules","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/60xxx/CVE-2026-60082.json","tags":["advisory"]},{"url":"https://github.com/perl5-dbi/dbi","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-60082","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0308.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35643","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/06/06/4","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/06/09/9","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/07/07/16","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/07/07/17","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/07/14/9","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/07/14/13","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/07/14/14","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/07/14/15","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3183","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14739","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15043","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-60081","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622845-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1271399","tags":["report"]},{"url":"https://bugzilla.suse.com/1271458","tags":["report"]},{"url":"https://bugzilla.suse.com/1271459","tags":["report"]},{"url":"https://bugzilla.suse.com/1271629","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-15043","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-15392","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-60081","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-60082","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622926-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263283-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1271017","tags":["report"]},{"url":"https://bugzilla.suse.com/1271018","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-14380","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-14740","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263415-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263461-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1271822","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-60082","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-60082","tags":["report"]},{"url":"https://lists.security.metacpan.org/cve-announce/msg/41813803/","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-60082","title":"DBI versions before 1.651 for Perl do not enforce statement handle consistency with the row","description":"DBI versions before 1.651 for Perl do not enforce statement handle consistency with the row.\n\nWhen the statement handle had no fields but the source row was non-empty, the internal row-buffer helper would read from a negative array index.\n\nThis could be triggered by a caller supplying inconsistent metadata and rows to the prepare method.","status":"published","published":"2026-07-14T15:35:00.73Z","modified":"2026-07-15T14:08:02.262Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T13:49:20.39253Z"}],"euvd":[{"id":"EUVD-2026-43729","description":"DBI versions before 1.651 for Perl do not enforce statement handle consistency with the row.\n\nWhen the statement handle had no fields but the source row was non-empty, the internal row-buffer helper would read from a negative array index.\n\nThis could be triggered by a caller supplying inconsistent metadata and rows to the prepare method.","status":"published","published":"2026-07-14T15:35:00Z","modified":"2026-07-15T14:08:02Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T18:19:53.226345Z"}],"nvd":[{"id":"CVE-2026-60082","description":"DBI versions before 1.651 for Perl do not enforce statement handle consistency with the row.\n\nWhen the statement handle had no fields but the source row was non-empty, the internal row-buffer helper would read from a negative array index.\n\nThis could be triggered by a caller supplying inconsistent metadata and rows to the prepare method.","status":"published","published":"2026-07-14T16:17:03.75Z","modified":"2026-10-24T21:10:00.13Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:12:29.114188Z"}],"osv":[{"id":"ALPINE-CVE-2026-60082","description":"DBI versions before 1.651 for Perl do not enforce statement handle consistency with the row.\n\nWhen the statement handle had no fields but the source row was non-empty, the internal row-buffer helper would read from a negative array index.\n\nThis could be triggered by a caller supplying inconsistent metadata and rows to the prepare method.","status":"published","published":"2026-07-14T16:17:03.75Z","modified":"2026-10-01T02:17:49.37548336Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:27:50.764331Z"},{"id":"BELL-CVE-2026-60082","status":"published","published":"2026-07-17T06:03:00.579781Z","modified":"2026-07-24T07:15:09.334067985Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:24.959902Z"},{"id":"CVE-2026-60082","title":"DBI versions before 1.651 for Perl do not enforce statement handle consistency with the row","description":"DBI versions before 1.651 for Perl do not enforce statement handle consistency with the row.\n\nWhen the statement handle had no fields but the source row was non-empty, the internal row-buffer helper would read from a negative array index.\n\nThis could be triggered by a caller supplying inconsistent metadata and rows to the prepare method.","status":"published","published":"2026-07-14T15:35:00.73Z","modified":"2026-10-28T02:30:54.897724305Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:45:12.933503Z"},{"id":"DEBIAN-CVE-2026-60082","description":"DBI versions before 1.651 for Perl do not enforce statement handle consistency with the row.  When the statement handle had no fields but the source row was non-empty, the internal row-buffer helper would read from a negative array index.  This could be triggered by a caller supplying inconsistent metadata and rows to the prepare method.","status":"published","published":"2026-07-14T16:17:03.75Z","modified":"2026-10-25T09:47:28.928718044Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:57.932517Z"},{"id":"OESA-2026-3183","title":"perl-DBI security update","description":"The DBI is the standard database interface module for Perl. It defines a set of methods, variables and conventions that provide a consistent database interface independent of the actual database being used. It is important to remember that the DBI is just an interface. The DBI is a layer of \u0026amp;quot;glue\u0026amp;quot; between an application and one or more database driver modules. It is the driver modules which do most of the real work. The DBI provides a standard interface and framework for the drivers to operate within.\r\n\r\nSecurity Fix(es):\n\nDBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders.\n\nThe fix for CVE-2026-10879 did not allocate enough memory to handle approximately 1.2-million placeholders.\n\nDBI version 1.650 sets a hard limit of 99,999 placeholders.(CVE-2026-14739)\n\nDBI::SQL::Nano versions from 1.42 before 1.651 for Perl have inverted \u0026lt;= and \u0026gt;= SQL operators on text.\n\nDBI::SQL::Nano, DBI\u0026apos;s built-in mini-SQL engine, evaluated WHERE predicates incorrectly in some cases. In the non-numeric string branch of the is_matched method, \u0026lt;= was evaluated using Perl\u0026apos;s ge operator, and \u0026gt;= was evaluated using Perl\u0026apos;s le operator.\n\nSQL::Nano is the fallback query engine for DBI\u0026apos;s file-backed drivers (DBD::File, DBD::DBM, CSV-style drivers) whenever SQL::Statement is not installed, and is forced whenever DBI_SQL_NANO=1. Queries over such tables use these predicates directly.\n\nThe impact depends on the context. Where an application relies on a WHERE clause to filter file-backed data for policy or authorization, an inverted \u0026lt;=/\u0026gt;= comparison silently returns the wrong rows.(CVE-2026-15043)\n\nDBI::ProfileData versions before 1.651 for Perl do not limit the path index.\n\nThe path index column of profile dump files is used to allocate an array of data for the parser. An unbounded value allows an attacker to specify a large index and consume available memory.(CVE-2026-60081)\n\nDBI versions before 1.651 for Perl do not enforce statement handle consistency with the row.\n\nWhen the statement handle had no fields but the source row was non-empty, the internal row-buffer helper would read from a negative array index.\n\nThis could be triggered by a caller supplying inconsistent metadata and rows to the prepare method.(CVE-2026-60082)","status":"published","published":"2026-07-24T11:12:03Z","modified":"2026-08-18T01:21:24.868996573Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"UBUNTU-CVE-2026-60082","description":"DBI versions before 1.651 for Perl do not enforce statement handle consistency with the row. When the statement handle had no fields but the source row was non-empty, the internal row-buffer helper would read from a negative array index. This could be triggered by a caller supplying inconsistent metadata and rows to the prepare method.","status":"published","published":"2026-07-14T16:17:00Z","modified":"2026-10-17T12:57:17.727174722Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T16:56:41.911783Z"},{"id":"AZL-92421","title":"CVE-2026-60082 affecting package perl-DBI for versions less than 1.651-1","description":"DBI versions before 1.651 for Perl do not enforce statement handle consistency with the row.\n\nWhen the statement handle had no fields but the source row was non-empty, the internal row-buffer helper would read from a negative array index.\n\nThis could be triggered by a caller supplying inconsistent metadata and rows to the prepare method.","status":"published","published":"2026-07-14T16:17:03Z","modified":"2026-08-28T17:56:36.587759Z","updated_at":"2026-11-02T15:28:11.723718Z"},{"id":"MGASA-2026-0308","title":"Updated perl-DBI packages fix security vulnerabilities","description":"The updated packages fix several security issues.\n","status":"published","published":"2026-07-30T17:03:15Z","modified":"2026-07-30T17:20:27.407974876Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11298-1","title":"perl-DBI-1.651.0-1.1 on GA media","description":"These are all security issues fixed in the perl-DBI-1.651.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-17T00:00:00Z","modified":"2026-07-18T08:45:08.431935316Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:21412-1","title":"Security update for perl-DBI","description":"This update for perl-DBI fixes the following issues:\n\n- CVE-2026-15392: failure to validate symbolic links during table path resolution could allow unauthorized file reads\n  and writes outside the configured data director (bsc#1271629).\n- CVE-2026-15043: `DBI:SQL:Nano` has incorrect predicate evaluation, which allows for bypass of file-backed filters\n  (bsc#1271399).\n- CVE-2026-60081: `DBI:ProfileData` does not limit the path index in profile parser, which enables small-file\n  memory-amplification DoS (bsc#1271458).\n- CVE-2026-60082: out-of-bounds access in `_set_fbav` when a statement handle has zero fields but a non-empty row,\n  which allows for a process crash (bsc#1271459).\n","status":"published","published":"2026-07-22T08:23:18Z","modified":"2026-07-24T18:24:26.386804707Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:22845-1","title":"Security update for perl-DBI","description":"This update for perl-DBI fixes the following issues:\n\n- CVE-2026-15392: failure to validate symbolic links during table path resolution could allow unauthorized file reads\n  and writes outside the configured data director (bsc#1271629).\n- CVE-2026-15043: `DBI:SQL:Nano` has incorrect predicate evaluation, which allows for bypass of file-backed filters\n  (bsc#1271399).\n- CVE-2026-60081: `DBI:ProfileData` does not limit the path index in profile parser, which enables small-file\n  memory-amplification DoS (bsc#1271458).\n- CVE-2026-60082: out-of-bounds access in `_set_fbav` when a statement handle has zero fields but a non-empty row,\n  which allows for a process crash (bsc#1271459).\n","status":"published","published":"2026-07-22T08:18:52Z","modified":"2026-07-28T18:24:09.368561793Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22926-1","title":"Security update for perl-DBI","description":"This update for perl-DBI fixes the following issues:\n\n- CVE-2026-15392: failure to validate symbolic links during table path resolution could allow unauthorized file reads\n  and writes outside the configured data director (bsc#1271629).\n- CVE-2026-15043: `DBI:SQL:Nano` has incorrect predicate evaluation, which allows for bypass of file-backed filters\n  (bsc#1271399).\n- CVE-2026-60081: `DBI:ProfileData` does not limit the path index in profile parser, which enables small-file\n  memory-amplification DoS (bsc#1271458).\n- CVE-2026-60082: out-of-bounds access in `_set_fbav` when a statement handle has zero fields but a non-empty row,\n  which allows for a process crash (bsc#1271459).\n","status":"published","published":"2026-07-22T08:18:52Z","modified":"2026-07-29T18:24:20.797864853Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:3283-1","title":"Security update for perl-DBI","description":"This update for perl-DBI fixes the following issues\n\n- CVE-2026-14380: unvalidated string eval interpolation of the Profile package name can lead to arbitrary Perl code\n  execution (bsc#1271018).\n- CVE-2026-14740: one-byte out-of-bounds read when deleting an initial SQL comment line can lead to a process crash\n  (bsc#1271017).\n- CVE-2026-15043: incorrect predicate evaluation in `DBI:SQL:Nano` can lead to bypass of file-backed filters\n  (bsc#1271399).\n- CVE-2026-15392: missing checks to ensure the table file is not a symlink to an untrusted location in `DBD::File`\n  allows for arbitrary file reads and writes (bsc#1271629).\n- CVE-2026-60081: no limiting of the path index in profile parser of `DBI:ProfileData` can enable small-file\n  memory-amplification DoS (bsc#1271458).\n- CVE-2026-60082: out-of-bounds access in `_set_fbav` when a statement handle has zero fields but a non-empty row\n  can lead to a process crash (bsc#1271459).\n","status":"published","published":"2026-07-27T13:45:29Z","modified":"2026-07-28T10:00:10.500404336Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"SUSE-SU-2026:3415-1","title":"Security update for perl-DBI","description":"This update for perl-DBI fixes the following issues\n\n- CVE-2026-14380: unvalidated string eval interpolation of the Profile package name can lead to arbitrary Perl code\n  execution (bsc#1271018).\n- CVE-2026-14740: one-byte out-of-bounds read when deleting an initial SQL comment line can lead to a process crash\n  (bsc#1271017).\n- CVE-2026-15043: incorrect predicate evaluation in `DBI:SQL:Nano` can lead to bypass of file-backed filters\n  (bsc#1271399).  \n- CVE-2026-15392: missing checks to ensure the table file is not a symlink to an untrusted location in `DBD::File`\n  allows for arbitrary file reads and writes (bsc#1271629).\n- CVE-2026-60081: no limiting of the path index in profile parser of `DBI:ProfileData` can enable small-file\n  memory-amplification DoS (bsc#1271458).\n- CVE-2026-60082: out-of-bounds access in `_set_fbav` when a statement handle has zero fields but a non-empty row\n  can lead to a process crash (bsc#1271459).\n","status":"published","published":"2026-07-30T06:54:43Z","modified":"2026-07-30T17:15:11.423115226Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"SUSE-SU-2026:3461-1","title":"Security update for perl-DBI","description":"This update for perl-DBI fixes the following issues:\n\n- CVE-2026-14380: unvalidated string eval interpolation of the Profile package name can lead to arbitrary Perl code\n  execution (bsc#1271018).\n- CVE-2026-14740: one-byte out-of-bounds read when deleting an initial SQL comment line can lead to a process crash\n  (bsc#1271017).\n- CVE-2026-15043: incorrect predicate evaluation in `DBI:SQL:Nano` can lead to bypass of file-backed filters\n  (bsc#1271399).\n- CVE-2026-15392: missing checks to ensure the table file is not a symlink to an untrusted location in `DBD::File`\n  allows for arbitrary file reads and writes (bsc#1271629).\n- CVE-2026-60081: no limiting of the path index in profile parser of `DBI:ProfileData` can enable small-file\n  memory-amplification DoS (bsc#1271458).\n- CVE-2026-60082: out-of-bounds access in `_set_fbav` when a statement handle has zero fields but a non-empty row\n  can lead to a process crash (bsc#1271459).\n\nChanges for perl-DBI:\n\n- missing method dependency in the path-containment guard can cause security check failures and functional regressions\n  when handling table symlinks (bsc#1271822).\n","status":"published","published":"2026-08-03T12:13:48Z","modified":"2026-08-04T11:45:08.868420805Z","updated_at":"2026-11-02T15:54:04.987808Z"}]}}