{"id":"CVE-2026-88815","aliases":["ALSA-2026:76760","ALSA-2026:76762","ALSA-2026:77576","ALSA-2026:85916","AZL-105212","BELL-CVE-2026-88815","CLSA-2026-1791807966","CLSA-2026-1791814009","DEBIAN-CVE-2026-88815","EUVD-2026-88342","GHSA-c8vq-w3wr-6979","MGASA-2026-0486","OESA-2026-4251","OESA-2026-4252","OESA-2026-4253","OESA-2026-4254","RHSA-2026:76760","RHSA-2026:76762","RHSA-2026:77576","RLSA-2026:76760","RLSA-2026:76762","RLSA-2026:77576","RLSA-2026:85916","SUSE-SU-2026:4442-1","SUSE-SU-2026:4612-1","SUSE-SU-2026:4805-1","UBUNTU-CVE-2026-88815","openSUSE-SU-2026:11966-1"],"status":"published","title":"DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in sql_type_cast_svpv","description":"DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in sql_type_cast_svpv.\n\nWhen casting to SQL_NUMERIC, sql_type_cast_svpv passes the string pointer and length of the SV to grok_number without stringifying it first. An integer (IV) or floating-point (NV) value has no valid string pointer, so grok_number reads from an invalid address, triggering a segmentation fault.\n\nThis is reachable in Perl using the sql_type_cast function:\n\n  my $num = 42;\n  DBI::sql_type_cast( $num, DBI::SQL_NUMERIC, 0 );","severity":{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00202,"percentile":0.10287,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-843"],"published":"2026-09-26T06:06:02.93632Z","modified":"2026-11-02T14:17:22Z","fixes":[{"ecosystem":"AlmaLinux:9","package":"perl-DBI","fixed_in":["1.643-9.el9_8.7"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"perl-DBI","fixed_in":["1.643-26.el10_2.7"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"perl-DBI","fixed_in":["1.641-4.el8_10","1.641-11.module_el8.10.0+4309+f7cd2555"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"perl-DBI","fixed_in":["1.655-1"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"perl-dbi","fixed_in":["1.654-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"perl-dbi","fixed_in":["1.654-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"perl-dbi","fixed_in":["1.654-r0"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"perl-DBI","fixed_in":["1.643-9.el9_6.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"perl-DBI","fixed_in":["1.643-9.el9_2.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libdbi-perl","fixed_in":["1.643-4+deb12u3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libdbi-perl","fixed_in":["1.654-1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"perl-DBI","fixed_in":["0:1.643-9.el9_8.7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"perl-DBI-debuginfo","fixed_in":["0:1.643-9.el9_8.7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"perl-DBI-debugsource","fixed_in":["0:1.643-9.el9_8.7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"perl-DBI","fixed_in":["0:1.643-26.el10_2.7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"perl-DBI-debuginfo","fixed_in":["0:1.643-26.el10_2.7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"perl-DBI-debugsource","fixed_in":["0:1.643-26.el10_2.7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"perl-DBI","fixed_in":["0:1.641-4.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"perl-DBI-debuginfo","fixed_in":["0:1.641-4.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"perl-DBI-debugsource","fixed_in":["0:1.641-4.el8_10"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"perl-DBI","fixed_in":["0:1.643-9.el9_8.7"],"sources":["osv"]},{"ecosystem":"Rocky Linux:10","package":"perl-DBI","fixed_in":["0:1.643-26.el10_2.7"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"perl-DBI","fixed_in":["0:1.641-4.el8_10","0:1.641-11.module+el8.10.0+40389+be9de675","0:1.641-11.module+el8.10.0+40389+69d937a8","0:1.641-11.module+el8.10.0+40389+22ad89a7","0:1.641-11.module+el8.10.0+40389+75d7e2a7"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:9","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.643-9.el9_8.7"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.643-26.el10_2.7"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.641-4.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.641-11.module_el8.10.0+4309+f7cd2555"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.655-1"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"perl-dbi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.643-r4"},{"fixed":"1.654-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"perl-dbi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.647-r0"},{"fixed":"1.654-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"perl-dbi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.643-r3"},{"fixed":"1.654-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.643-9.el9_6.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.643-9.el9_2.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.643-4+deb12u3"}]}],"versions":["1.643-4","1.643-4+deb12u1","1.643-4+deb12u2"]},{"source":"osv","ecosystem":"Debian:13","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.647-1","1.647-1+deb13u1","1.648-1","1.649-1","1.650-1","1.651-1","1.652-1","1.652-2","1.652-2~deb13u1","1.653-1","1.654-1"]},{"source":"osv","ecosystem":"Debian:14","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.654-1"}]}],"versions":["1.647-1","1.648-1","1.649-1","1.650-1","1.651-1","1.652-1","1.652-2","1.652-2~deb13u1","1.653-1"]},{"source":"osv","ecosystem":"Mageia:10","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.655.0-1.mga10"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.643-12.oe2203sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.643-12.oe2403sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.643-12.oe2403sp3"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.648-8.oe2403sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.643-9.el9_8.7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"perl-DBI-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.643-9.el9_8.7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"perl-DBI-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.643-9.el9_8.7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.643-26.el10_2.7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"perl-DBI-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.643-26.el10_2.7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"perl-DBI-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.643-26.el10_2.7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.641-4.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"perl-DBI-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.641-4.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"perl-DBI-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.641-4.el8_10"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.643-9.el9_8.7"}]}]},{"source":"osv","ecosystem":"Rocky Linux:10","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.643-26.el10_2.7"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.641-4.el8_10"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.641-11.module+el8.10.0+40389+be9de675"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.641-11.module+el8.10.0+40389+69d937a8"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.641-11.module+el8.10.0+40389+22ad89a7"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.641-11.module+el8.10.0+40389+75d7e2a7"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.628-5.29.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.642-150200.3.26.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.642-150200.3.26.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.642-150200.3.26.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.642-150200.3.26.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.642-150200.3.26.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.642-150200.3.26.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.642-150200.3.26.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.642-150200.3.26.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.647.0-150600.12.26.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.627-1","1.628-1","1.630-1","1.630-1ubuntu0.1~esm1","1.630-1ubuntu0.1~esm4","1.630-1ubuntu0.1~esm5","1.630-1ubuntu0.1~esm6","1.630-1ubuntu0.1~esm8","1.630-1ubuntu0.1~esm9"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.633-1","1.634-1","1.634-1build1","1.634-1ubuntu0.1","1.634-1ubuntu0.2","1.634-1ubuntu0.2+esm1","1.634-1ubuntu0.2+esm2","1.634-1ubuntu0.2+esm4","1.634-1ubuntu0.2+esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.637-1","1.639-1","1.640-1","1.640-1ubuntu0.1","1.640-1ubuntu0.2","1.640-1ubuntu0.3","1.640-1ubuntu0.3+esm1","1.640-1ubuntu0.3+esm3","1.640-1ubuntu0.3+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.642-1","1.642-1build1","1.643-1","1.643-1ubuntu0.1","1.643-1ubuntu0.1+esm1","1.643-1ubuntu0.1+esm3","1.643-1ubuntu0.1+esm4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.643-3build2","1.643-3build3","1.643-3ubuntu0.1","1.643-3ubuntu0.3","1.643-3ubuntu0.4"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.643-4","1.643-4build1","1.643-4build2","1.643-4build3","1.643-4ubuntu0.1","1.643-4ubuntu0.3","1.643-4ubuntu0.4"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.647-1build1","1.648-1","1.651-1","1.652-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.647-1","1.647-1build1","1.647-1ubuntu0.26.04.1","1.647-1ubuntu0.26.04.3","1.647-1ubuntu0.26.04.4"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.655.0-1.1"}]}],"bundled":2}],"references":[{"url":"https://github.com/perl5-dbi/dbi/security/advisories/GHSA-c8vq-w3wr-6979","tags":["vendor-advisory","exploit","advisory","article"]},{"url":"https://github.com/perl5-dbi/dbi/commit/e5ad87e5602da995d28b4d65df222368b58d6702.patch","tags":["patch","fix","article"]},{"url":"https://metacpan.org/release/HMBRAND/DBI-1.654/changes","tags":["release-notes","advisory","article"]},{"url":"http://www.openwall.com/lists/oss-security/2026/09/28/12","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:76760","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-88815","tags":["report"]},{"url":"https://bugzilla.redhat.com/2542559","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-76760.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:76762","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-76762.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:77576","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-77576.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:85916","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-85916.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88815","tags":["web","advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-88815","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1791807966.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1791814009.html","tags":["advisory"]},{"url":"https://cpan.org/modules","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/88xxx/CVE-2026-88815.json","tags":["advisory"]},{"url":"https://github.com/perl5-dbi/dbi","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-88815","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0486.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36312","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X2QBTFMS57S7DYK666C4OQBHWDRGW3Q7/","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/09/19/4","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/09/28/12","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/09/28/13","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4251","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88816","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4252","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4253","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4254","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2542559","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_76760.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-88815","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_76762.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_77576.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:76760","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:76762","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:77576","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:85916","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264442-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1283055","tags":["report"]},{"url":"https://bugzilla.suse.com/1283056","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-88815","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-88816","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264612-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1281704","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78030","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264805-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-88815","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-88815","title":"DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in sql_type_cast_svpv","description":"DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in sql_type_cast_svpv.\n\nWhen casting to SQL_NUMERIC, sql_type_cast_svpv passes the string pointer and length of the SV to grok_number without stringifying it first. An integer (IV) or floating-point (NV) value has no valid string pointer, so grok_number reads from an invalid address, triggering a segmentation fault.\n\nThis is reachable in Perl using the sql_type_cast function:\n\n  my $num = 42;\n  DBI::sql_type_cast( $num, DBI::SQL_NUMERIC, 0 );","status":"published","published":"2026-09-28T16:04:22.057Z","modified":"2026-09-30T19:52:38.366Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"adp"}],"cwes":["CWE-843"],"updated_at":"2026-11-02T13:41:53.237769Z"}],"euvd":[{"id":"EUVD-2026-88342","description":"DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in sql_type_cast_svpv.\n\nWhen casting to SQL_NUMERIC, sql_type_cast_svpv passes the string pointer and length of the SV to grok_number without stringifying it first. An integer (IV) or floating-point (NV) value has no valid string pointer, so grok_number reads from an invalid address, triggering a segmentation fault.\n\nThis is reachable in Perl using the sql_type_cast function:\n\n  my $num = 42;\n  DBI::sql_type_cast( $num, DBI::SQL_NUMERIC, 0 );","status":"published","published":"2026-09-28T16:04:22Z","modified":"2026-09-30T19:52:38Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T17:27:47.293232Z"}],"nvd":[{"id":"CVE-2026-88815","description":"DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in sql_type_cast_svpv.\n\nWhen casting to SQL_NUMERIC, sql_type_cast_svpv passes the string pointer and length of the SV to grok_number without stringifying it first. An integer (IV) or floating-point (NV) value has no valid string pointer, so grok_number reads from an invalid address, triggering a segmentation fault.\n\nThis is reachable in Perl using the sql_type_cast function:\n\n  my $num = 42;\n  DBI::sql_type_cast( $num, DBI::SQL_NUMERIC, 0 );","status":"published","published":"2026-09-28T17:17:52.07Z","modified":"2026-09-30T20:17:35.38Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-843"],"updated_at":"2026-11-02T14:12:52.081323Z"}],"osv":[{"id":"BELL-CVE-2026-88815","status":"published","published":"2026-09-26T06:06:02.93632Z","modified":"2026-10-02T07:15:03.433959029Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:26.630331Z"},{"id":"CVE-2026-88815","title":"DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in sql_type_cast_svpv","description":"DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in sql_type_cast_svpv.\n\nWhen casting to SQL_NUMERIC, sql_type_cast_svpv passes the string pointer and length of the SV to grok_number without stringifying it first. An integer (IV) or floating-point (NV) value has no valid string pointer, so grok_number reads from an invalid address, triggering a segmentation fault.\n\nThis is reachable in Perl using the sql_type_cast function:\n\n  my $num = 42;\n  DBI::sql_type_cast( $num, DBI::SQL_NUMERIC, 0 );","status":"published","published":"2026-09-28T16:04:22.057Z","modified":"2026-10-28T02:30:21.617100808Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-843"],"updated_at":"2026-11-02T15:45:19.210277Z"},{"id":"DEBIAN-CVE-2026-88815","description":"DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in sql_type_cast_svpv.  When casting to SQL_NUMERIC, sql_type_cast_svpv passes the string pointer and length of the SV to grok_number without stringifying it first. An integer (IV) or floating-point (NV) value has no valid string pointer, so grok_number reads from an invalid address, triggering a segmentation fault.  This is reachable in Perl using the sql_type_cast function:    my $num = 42;   DBI::sql_type_cast( $num, DBI::SQL_NUMERIC, 0 );","status":"published","published":"2026-09-28T17:17:52.07Z","modified":"2026-10-01T09:00:57.06116729Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:46:05.506112Z"},{"id":"OESA-2026-4251","title":"perl-DBI security update","description":"The DBI is the standard database interface module for Perl. It defines a set of methods, variables and conventions that provide a consistent database interface independent of the actual database being used. It is important to remember that the DBI is just an interface. The DBI is a layer of \u0026amp;quot;glue\u0026amp;quot; between an application and one or more database driver modules. It is the driver modules which do most of the real work. The DBI provides a standard interface and framework for the drivers to operate within.\r\n\r\nSecurity Fix(es):\n\nDBI versions before 1.654 for Perl incorrectly treat numeric values as strings in sql_type_cast_svpv.\n\nWhen casting to SQL_NUMERIC, sql_type_cast_svpv passes the string pointer and length of the SV to grok_number without stringifying it first. An integer (IV) or floating-point (NV) value has no valid string pointer, so grok_number reads from an invalid address, triggering a segmentation fault.\n\nThis is reachable in Perl using the sql_type_cast function:\n\n  my $num = 42;\n  DBI::sql_type_cast( $num, DBI::SQL_NUMERIC, 0 );(CVE-2026-88815)\n\nDBI versions before 1.654 for Perl incorrectly treat numeric values as strings in FetchHashKeyName.\n\nfetchrow_hashref uses the string pointer of the FetchHashKeyName attribute as the key name without stringifying it first. When FetchHashKeyName has been set to an integer (IV) or floating-point (NV) value, that pointer is invalid, so reading the key name triggers a segmentation fault.\n\nThis can be triggered with the following code:\n\n   my $dbh = DBI-\u0026gt;connect( \u0026quot;dbi:ExampleP:\u0026quot;, \u0026quot;\u0026quot;, \u0026quot;\u0026quot;,\n       { RaiseError =\u0026gt; 0, PrintError =\u0026gt; 0 } );\n   $dbh-\u0026gt;{FetchHashKeyName} = 42;\n\n   my $sth = $dbh-\u0026gt;prepare(\u0026quot;select mode, size, name from .\u0026quot;);\n   $sth-\u0026gt;execute;\n   $sth-\u0026gt;fetchrow_hashref;(CVE-2026-88816)","status":"published","published":"2026-10-16T11:58:36Z","modified":"2026-10-16T12:15:05.299740579Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-4252","title":"perl-DBI security update","description":"The DBI is the standard database interface module for Perl. It defines a set of methods, variables and conventions that provide a consistent database interface independent of the actual database being used. It is important to remember that the DBI is just an interface. The DBI is a layer of \u0026amp;quot;glue\u0026amp;quot; between an application and one or more database driver modules. It is the driver modules which do most of the real work. The DBI provides a standard interface and framework for the drivers to operate within.\r\n\r\nSecurity Fix(es):\n\nDBI versions before 1.654 for Perl incorrectly treat numeric values as strings in sql_type_cast_svpv.\n\nWhen casting to SQL_NUMERIC, sql_type_cast_svpv passes the string pointer and length of the SV to grok_number without stringifying it first. An integer (IV) or floating-point (NV) value has no valid string pointer, so grok_number reads from an invalid address, triggering a segmentation fault.\n\nThis is reachable in Perl using the sql_type_cast function:\n\n  my $num = 42;\n  DBI::sql_type_cast( $num, DBI::SQL_NUMERIC, 0 );(CVE-2026-88815)\n\nDBI versions before 1.654 for Perl incorrectly treat numeric values as strings in FetchHashKeyName.\n\nfetchrow_hashref uses the string pointer of the FetchHashKeyName attribute as the key name without stringifying it first. When FetchHashKeyName has been set to an integer (IV) or floating-point (NV) value, that pointer is invalid, so reading the key name triggers a segmentation fault.\n\nThis can be triggered with the following code:\n\n   my $dbh = DBI-\u0026gt;connect( \u0026quot;dbi:ExampleP:\u0026quot;, \u0026quot;\u0026quot;, \u0026quot;\u0026quot;,\n       { RaiseError =\u0026gt; 0, PrintError =\u0026gt; 0 } );\n   $dbh-\u0026gt;{FetchHashKeyName} = 42;\n\n   my $sth = $dbh-\u0026gt;prepare(\u0026quot;select mode, size, name from .\u0026quot;);\n   $sth-\u0026gt;execute;\n   $sth-\u0026gt;fetchrow_hashref;(CVE-2026-88816)","status":"published","published":"2026-10-16T11:58:37Z","modified":"2026-10-16T12:15:04.294974638Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-4253","title":"perl-DBI security update","description":"The DBI is the standard database interface module for Perl. It defines a set of methods, variables and conventions that provide a consistent database interface independent of the actual database being used. It is important to remember that the DBI is just an interface. The DBI is a layer of \u0026amp;quot;glue\u0026amp;quot; between an application and one or more database driver modules. It is the driver modules which do most of the real work. The DBI provides a standard interface and framework for the drivers to operate within.\r\n\r\nSecurity Fix(es):\n\nDBI versions before 1.654 for Perl incorrectly treat numeric values as strings in sql_type_cast_svpv.\n\nWhen casting to SQL_NUMERIC, sql_type_cast_svpv passes the string pointer and length of the SV to grok_number without stringifying it first. An integer (IV) or floating-point (NV) value has no valid string pointer, so grok_number reads from an invalid address, triggering a segmentation fault.\n\nThis is reachable in Perl using the sql_type_cast function:\n\n  my $num = 42;\n  DBI::sql_type_cast( $num, DBI::SQL_NUMERIC, 0 );(CVE-2026-88815)\n\nDBI versions before 1.654 for Perl incorrectly treat numeric values as strings in FetchHashKeyName.\n\nfetchrow_hashref uses the string pointer of the FetchHashKeyName attribute as the key name without stringifying it first. When FetchHashKeyName has been set to an integer (IV) or floating-point (NV) value, that pointer is invalid, so reading the key name triggers a segmentation fault.\n\nThis can be triggered with the following code:\n\n   my $dbh = DBI-\u0026gt;connect( \u0026quot;dbi:ExampleP:\u0026quot;, \u0026quot;\u0026quot;, \u0026quot;\u0026quot;,\n       { RaiseError =\u0026gt; 0, PrintError =\u0026gt; 0 } );\n   $dbh-\u0026gt;{FetchHashKeyName} = 42;\n\n   my $sth = $dbh-\u0026gt;prepare(\u0026quot;select mode, size, name from .\u0026quot;);\n   $sth-\u0026gt;execute;\n   $sth-\u0026gt;fetchrow_hashref;(CVE-2026-88816)","status":"published","published":"2026-10-16T11:58:37Z","modified":"2026-10-16T12:15:05.208242341Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-4254","title":"perl-DBI security update","description":"The DBI is the standard database interface module for Perl. It defines a set of methods, variables and conventions that provide a consistent database interface independent of the actual database being used. It is important to remember that the DBI is just an interface. The DBI is a layer of \u0026amp;quot;glue\u0026amp;quot; between an application and one or more database driver modules. It is the driver modules which do most of the real work. The DBI provides a standard interface and framework for the drivers to operate within.\r\n\r\nSecurity Fix(es):\n\nDBI versions before 1.654 for Perl incorrectly treat numeric values as strings in sql_type_cast_svpv.\n\nWhen casting to SQL_NUMERIC, sql_type_cast_svpv passes the string pointer and length of the SV to grok_number without stringifying it first. An integer (IV) or floating-point (NV) value has no valid string pointer, so grok_number reads from an invalid address, triggering a segmentation fault.\n\nThis is reachable in Perl using the sql_type_cast function:\n\n  my $num = 42;\n  DBI::sql_type_cast( $num, DBI::SQL_NUMERIC, 0 );(CVE-2026-88815)\n\nDBI versions before 1.654 for Perl incorrectly treat numeric values as strings in FetchHashKeyName.\n\nfetchrow_hashref uses the string pointer of the FetchHashKeyName attribute as the key name without stringifying it first. When FetchHashKeyName has been set to an integer (IV) or floating-point (NV) value, that pointer is invalid, so reading the key name triggers a segmentation fault.\n\nThis can be triggered with the following code:\n\n   my $dbh = DBI-\u0026gt;connect( \u0026quot;dbi:ExampleP:\u0026quot;, \u0026quot;\u0026quot;, \u0026quot;\u0026quot;,\n       { RaiseError =\u0026gt; 0, PrintError =\u0026gt; 0 } );\n   $dbh-\u0026gt;{FetchHashKeyName} = 42;\n\n   my $sth = $dbh-\u0026gt;prepare(\u0026quot;select mode, size, name from .\u0026quot;);\n   $sth-\u0026gt;execute;\n   $sth-\u0026gt;fetchrow_hashref;(CVE-2026-88816)","status":"published","published":"2026-10-16T11:58:38Z","modified":"2026-10-16T12:15:05.196193009Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"RHSA-2026:76760","title":"Red Hat Security Advisory: perl-DBI security update","status":"published","published":"2026-10-10T10:22:03Z","modified":"2026-10-17T10:20:06Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:76762","title":"Red Hat Security Advisory: perl-DBI security update","status":"published","published":"2026-10-07T10:20:12Z","modified":"2026-10-17T10:20:07Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:77576","title":"Red Hat Security Advisory: perl-DBI security update","status":"published","published":"2026-10-08T10:20:23Z","modified":"2026-10-17T10:20:19Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RLSA-2026:76760","title":"Important: perl-DBI security update","description":"The perl-DBI package provides the standard database interface module for the Perl programming language. It implements a database-independent interface, meaning it defines a consistent set of methods, variables, and conventions for database operations.\n\nSecurity Fix(es):\n\n* perl-DBI: perl-DBI: Denial of Service via invalid memory read during numeric type casting (CVE-2026-88815)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-08T18:05:10.940133Z","modified":"2026-10-08T18:30:02.033540822Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:76762","title":"Important: perl-DBI security update","description":"The perl-DBI package provides the standard database interface module for the Perl programming language. It implements a database-independent interface, meaning it defines a consistent set of methods, variables, and conventions for database operations.\n\nSecurity Fix(es):\n\n* perl-DBI: perl-DBI: Denial of Service via invalid memory read during numeric type casting (CVE-2026-88815)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-07T12:10:19.768697Z","modified":"2026-10-07T12:30:02.584807189Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:77576","title":"Important: perl-DBI security update","description":"The perl-DBI package provides the standard database interface module for the Perl programming language. It implements a database-independent interface, meaning it defines a consistent set of methods, variables, and conventions for database operations.\n\nSecurity Fix(es):\n\n* perl-DBI: perl-DBI: Denial of Service via invalid memory read during numeric type casting (CVE-2026-88815)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-08T06:03:13.077958Z","modified":"2026-10-08T06:45:02.759642706Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:85916","title":"Important: perl-DBI:1.641 security update","description":"The perl-DBI package provides the standard database interface module for the Perl programming language. It implements a database-independent interface, meaning it defines a consistent set of methods, variables, and conventions for database operations.\n\nSecurity Fix(es):\n\n* perl-DBI: perl-DBI: Denial of Service via invalid memory read during numeric type casting (CVE-2026-88815)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-22T00:01:17.335044Z","modified":"2026-10-22T00:30:03.397850847Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"UBUNTU-CVE-2026-88815","description":"DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in sql_type_cast_svpv. When casting to SQL_NUMERIC, sql_type_cast_svpv passes the string pointer and length of the SV to grok_number without stringifying it first. An integer (IV) or floating-point (NV) value has no valid string pointer, so grok_number reads from an invalid address, triggering a segmentation fault. This is reachable in Perl using the sql_type_cast function:   my $num = 42;   DBI::sql_type_cast( $num, DBI::SQL_NUMERIC, 0 );","status":"published","published":"2026-09-28T17:17:00Z","modified":"2026-10-17T13:01:15.76214648Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:57:24.828975Z"},{"id":"ALSA-2026:76760","title":"Important: perl-DBI security update","description":"The perl-DBI package provides the standard database interface module for the Perl programming language. It implements a database-independent interface, meaning it defines a consistent set of methods, variables, and conventions for database operations.  \n\nSecurity Fix(es):  \n\n  * perl-DBI: perl-DBI: Denial of Service via invalid memory read during numeric type casting (CVE-2026-88815)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-06T00:00:00Z","modified":"2026-10-29T11:32:37.586848056Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:76762","title":"Important: perl-DBI security update","description":"The perl-DBI package provides the standard database interface module for the Perl programming language. It implements a database-independent interface, meaning it defines a consistent set of methods, variables, and conventions for database operations.  \n\nSecurity Fix(es):  \n\n  * perl-DBI: perl-DBI: Denial of Service via invalid memory read during numeric type casting (CVE-2026-88815)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-06T00:00:00Z","modified":"2026-10-29T11:30:50.626954747Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:77576","title":"Important: perl-DBI security update","description":"The perl-DBI package provides the standard database interface module for the Perl programming language. It implements a database-independent interface, meaning it defines a consistent set of methods, variables, and conventions for database operations.  \n\nSecurity Fix(es):  \n\n  * perl-DBI: perl-DBI: Denial of Service via invalid memory read during numeric type casting (CVE-2026-88815)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-07T00:00:00Z","modified":"2026-10-29T11:02:29.666267761Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:85916","title":"Important: perl-DBI:1.641 security update","description":"The perl-DBI package provides the standard database interface module for the Perl programming language. It implements a database-independent interface, meaning it defines a consistent set of methods, variables, and conventions for database operations.  \n\nSecurity Fix(es):  \n\n  * perl-DBI: perl-DBI: Denial of Service via invalid memory read during numeric type casting (CVE-2026-88815)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-20T00:00:00Z","modified":"2026-10-29T11:02:25.332484454Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"AZL-105212","title":"CVE-2026-88815 affecting package perl-DBI for versions less than 1.655-1","description":"DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in sql_type_cast_svpv.\n\nWhen casting to SQL_NUMERIC, sql_type_cast_svpv passes the string pointer and length of the SV to grok_number without stringifying it first. An integer (IV) or floating-point (NV) value has no valid string pointer, so grok_number reads from an invalid address, triggering a segmentation fault.\n\nThis is reachable in Perl using the sql_type_cast function:\n\n  my $num = 42;\n  DBI::sql_type_cast( $num, DBI::SQL_NUMERIC, 0 );","status":"published","published":"2026-09-28T17:17:52Z","modified":"2026-11-02T14:17:22.684983696Z","updated_at":"2026-11-02T15:28:01.09948Z"},{"id":"CLSA-2026-1791807966","title":"perl-DBI: Fix of CVE-2026-88815","description":"- CVE-2026-88815: stringify the value in sql_type_cast_svpv() before\n  passing it to grok_number() for SQL_NUMERIC casts, so a plain integer\n  or floating-point value no longer crashes DBI::sql_type_cast(); add the\n  upstream t/90sql_type_cast.t cases","status":"published","published":"2026-10-12T12:26:16Z","modified":"2026-10-26T09:31:36.613301652Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1791814009","title":"perl-DBI: Fix of CVE-2026-88815","description":"- CVE-2026-88815: stringify the value in sql_type_cast_svpv() before\n  passing it to grok_number() for SQL_NUMERIC casts, so a plain integer\n  or floating-point value no longer crashes DBI::sql_type_cast(); add the\n  upstream t/90sql_type_cast.t cases","status":"published","published":"2026-10-12T16:52:04Z","modified":"2026-10-26T09:30:15.68504019Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"MGASA-2026-0486","title":"Updated perl-DBI package fixes security vulnerabilities","description":"DBI versions before 1.653 for Perl load arbitrary modules via\nunvalidated dbm_type and dbm_mldbm attributes in DBD::DBM.\n(CVE-2026-78030)\nDBI versions before 1.654 for Perl incorrectly treat numeric values as\nstrings in sql_type_cast_svpv. (CVE-2026-88815)\nDBI versions before 1.654 for Perl incorrectly treat numeric values as\nstrings in FetchHashKeyName. (CVE-2026-88816)\n","status":"published","published":"2026-10-12T18:47:12Z","modified":"2026-10-12T19:00:45.056075326Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11966-1","title":"perl-DBI-1.655.0-1.1 on GA media","description":"These are all security issues fixed in the perl-DBI-1.655.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-02T00:00:00Z","modified":"2026-10-03T17:23:10.032196615Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"SUSE-SU-2026:4442-1","title":"Security update for perl-DBI","description":"This update for perl-DBI fixes the following issues:\n\n- CVE-2026-88815: numeric value incorrectly treated as strings in `sql_type_cast_svpv` allows for process crash\n  (bsc#1283055).\n- CVE-2026-88816: numeric value incorrectly treated as strings in `FetchHashKeyName` allows for process crash\n  (bsc#1283056).\n","status":"published","published":"2026-10-05T08:18:25Z","modified":"2026-10-05T18:00:05.538243207Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4612-1","title":"Security update for perl-DBI","description":"This update for perl-DBI fixes the following issues:\n\n- CVE-2026-78030: arbitrary modules loaded due to unvalidated `dbm_type` and `dbm_mldbm` attributes in `DBD::DBM`\n  (bsc#1281704).\n- CVE-2026-88815: numeric value incorrectly treated as strings in `sql_type_cast_svpv` allows for process crash\n  (bsc#1283055).\n- CVE-2026-88816: numeric value incorrectly treated as strings in `FetchHashKeyName` allows for process crash\n  (bsc#1283056).\n","status":"published","published":"2026-10-09T15:56:45Z","modified":"2026-10-10T09:30:06.449818329Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4805-1","title":"Security update for perl-DBI","description":"This update for perl-DBI fixes the following issues:\n\n- CVE-2026-88815: numeric value incorrectly treated as strings in `sql_type_cast_svpv` allows for process crash\n  (bsc#1283055).\n- CVE-2026-88816: numeric value incorrectly treated as strings in `FetchHashKeyName` allows for process crash\n  (bsc#1283056).\n","status":"published","published":"2026-10-21T08:01:10Z","modified":"2026-10-21T20:02:15.439538218Z","updated_at":"2026-11-02T15:54:05.838224Z"}]}}