Skip to main content

Perl DBI CVE-2026-10879

| EUVDEUVD-2026-34843 CRITICAL
Out-of-bounds Write (CWE-787)
2026-06-05 CPANSec GHSA-c7xw-cj86-m724
Buffer Overflow Memory Corruption Dbi Hmbrand
Critical
Disputed · 9.8 Vendor: CPANSec
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Identify Perl app calling DBI preparse
  2. Delivery
    Submit SQL with 10+ placeholders
  3. Exploit
    preparse expands :p10+ tokens past buffer
  4. Execution
    Heap overflow in Perl SV
  5. Persist
    Corrupt adjacent interpreter structures
  6. Impact
    Crash or arbitrary code execution

Vulnerability Assessment

Weakness
CWE
CWE-787
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK

2 techniques across 2 tactics: Execution, Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires an attacker to control the SQL statement string passed to DBI's preparse() method (DBI.xs preparse() routine), and that string must contain ten or more placeholder characters so the expanded :pN tokens exceed the three-bytes-per-placeholder buffer assumption. Limiting factors: preparse() is a niche entry point - typical DBI usage goes through prepare()/execute() with bind parameters, which is NOT vulnerable; the calling Perl process must additionally route untrusted input into the SQL template (not just bind values); the target must be running DBI prior to 1.648 with a Perl/libc heap layout amenable to corruption. Despite CVSS AV:N, network reachability is not intrinsic - it depends entirely on whether the host application surfaces preparse() to remote input.
Impact

The signals here conflict sharply and warrant careful interpretation. CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) reflects worst-case heap corruption with potential RCE, but this rating is misleading for DBI specifically: the preparse() routine is not exposed over the network - it processes SQL strings supplied by the calling Perl application. Real-world exploitability therefore depends on whether an application passes attacker-controlled SQL (with 10+ placeholders) into DBI->preparse(), which is an uncommon code path; most applications use prepare()/execute() with bind values, not preparse(). EPSS at 0.02% (5th percentile) and absence from CISA KEV align with that reality. No public exploit identified at time of analysis. The bug is genuine memory corruption worth patching promptly across the Perl ecosystem, but it is not a drop-everything internet-exposed RCE despite the CVSS number - treat it as a standard library update during normal patching cycles unless an application is known to pass untrusted SQL into preparse().
Exploit ScenarioDerived

A Perl application exposes a feature where users (or upstream data) influence SQL templates passed into DBI's preparse() - for example a reporting tool, ORM helper, or migration utility that rewrites placeholders. An attacker supplies a SQL string containing 10+ '?' placeholders, causing preparse() to write past the SV buffer when expanding them to :p10, :p11, ..., corrupting adjacent Perl heap structures and potentially leading to interpreter crash or, with careful heap grooming, code execution in the Perl process. No public proof-of-concept has been published.
Act Now Prioritize within 24-48h. Why: CRITICAL severity.
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 08, 2026

Heap buffer overflow in the Perl DBI module versions before 1.648 occurs when the preparse() function processes SQL statements containing 10 or more placeholder binders. The fixed-size buffer allocation (three characters per binder) is insufficient for multi-digit binder names like :p10 through :p99 (four chars) or :p100+ (five chars), enabling memory corruption. EPSS rates exploitation probability at only 0.02% (5th percentile) and no public exploit identified at time of analysis, but the upstream maintainer has shipped a fix expanding the allocation.

RemediationAI

Vendor-released patch: DBI 1.648 - upgrade via cpan DBI, cpanm DBI, or the OS package manager once distribution rebuilds land (Debian libdbi-perl, Red Hat perl-DBI, etc.). The fix is a one-line allocation change in DBI.xs (newSV(strlen(statement) * 6 + 16)) visible at https://github.com/perl5-dbi/dbi/commit/af79036c07aa9a457971c0f4136e37c85dc20978.patch with full changelog at https://metacpan.org/release/HMBRAND/DBI-1.648/changes and the oss-security announcement at https://seclists.org/oss-sec/2026/q2/825. If immediate upgrade is impractical, the compensating control is to audit application code for direct callers of DBI->preparse() and ensure the SQL argument is never derived from untrusted input - note this is application-level only; ordinary prepare()/execute() flows are not the affected path. Restricting placeholder counts to under 10 in any preparse() call avoids the overflow but is brittle and not a substitute for the patch.

Affected VersionsENISA

DBI 0 <1.648

Affected Packages

euvd dbi fix: 1.648

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

DBI (Database Independent Interface) is the foundational database abstraction layer for Perl, used by virtually every Perl application that touches a database (DBD::Pg, DBD::mysql, DBD::Oracle, DBD::SQLite all sit on top of it). The vulnerability lives in DBI.xs preparse(), an XS (C-level) routine that rewrites SQL placeholder syntax. As shown in commit af79036c, the original allocation was newSV(strlen(statement) * 3) - assuming each placeholder character expands into at most three bytes (:pN). However, the Nth binder generates a token of length 3 + floor(log10(N)) characters, so placeholders 10-99 need four bytes, 100-999 need five, and so on. Writing past the SV buffer constitutes a CWE-787 out-of-bounds write on the Perl interpreter heap. The fix reallocates as strlen(statement) * 6 + 16, providing headroom up to roughly 999,999 binders.

Know when Dbi gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Medium–Critical)
Vendor (CPANSec) PRIMARY 9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SUSE 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat 7.7 HIGH

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: CPANSec

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
CVSS changed
Jun 08, 2026 - 18:22 NVD
9.8 (CRITICAL)
CVE Published
Jun 05, 2026 - 14:30 nvd
UNKNOWN (no severity yet)

DescriptionCVE.org

DBI versions before 1.648 for Perl have a heap overflow when preparsing SQL statements with more than 9 binders.

The preparse method expands SQL placeholder characters to numbered binders of the form :pN, but only allocates three characters per binder in the buffer. Placeholders 10-99 require four characters, 100-999 require five characters, et cetera.

Executive ViewAI

Why It Matters

The Perl DBI module (versions before 1.648) contains a critical heap buffer overflow vulnerability affecting any database-connected application using Perl. While the vulnerability has a high technical severity score, no public exploitation has been identified and real-world attack probability is negligible. Organizations should upgrade to version 1.648 or later within 7 days as part of routine patch management.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.0%
Top 95% exploitable
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment MSRC Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
CRITICAL severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
High
Technical Impact
Total

Priority Score

49
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +49
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

More in Dbi

View all
CVE-2026-14739 CRITICAL
9.8 Jul 07

Heap out-of-bounds write in the Perl DBI database-interface module before version 1.650 occurs when DBI preparses a SQL

CVE-2026-15043 CRITICAL
9.8 Jul 14

Incorrect WHERE-clause evaluation in Perl's DBI::SQL::Nano (versions 1.42 up to 1.651) causes text-based '<=' and '>=' c
CVE-2026-9698 CRITICAL
9.8 Jun 09

Stack-based buffer overflow in Perl DBI module versions prior to 1.648 allows attackers who can influence database error
CVE-2026-60082 CRITICAL
9.1 Jul 14

Out-of-bounds read in the Perl DBI (Database Independent Interface) module before version 1.651 lets a caller trigger a

CVE-2026-14740 CRITICAL
9.1 Jul 07

Out-of-bounds read in the Perl DBI module's preparse() SQL-normalisation routine allows an attacker who controls SQL pas
CVE-2026-14380 HIGH
8.8 Jul 07

Arbitrary Perl code execution in the DBI database-interface module (versions before 1.650) allows attackers who influenc
CVE-2026-60081 HIGH
7.5 Jul 14

Memory-exhaustion denial of service in the DBI::ProfileData module (bundled with Perl DBI) before version 1.651 allows a

Same weakness CWE-787 – Out-of-bounds Write

View all
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2012-1889 HIGH POC
8.8
CVE-2010-3333 HIGH POC
7.8
CVE-2014-1761 HIGH POC
7.8
CVE-2009-3129 HIGH POC
7.8
CVE-2021-1732 HIGH POC
7.8
CVE-2013-3346 CRITICAL POC
9.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7 Affected

References

Advisories & patches
PATCH https://github.com/perl5-dbi/dbi/commit/af79036c07aa9a457971c0f4136e37c85dc20978.patch ADVISORY https://access.redhat.com/errata/RHSA-2026:38512 ADVISORY https://access.redhat.com/errata/RHSA-2026:38513 ADVISORY https://access.redhat.com/errata/RHSA-2026:38901 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-10879 ADVISORY https://seclists.org/oss-sec/2026/q2/825 ADVISORY https://seclists.org/oss-sec/2026/q3/502 ADVISORY https://ubuntu.com/security/notices/USN-8466-1 ADVISORY https://vuldb.com/vuln/368928 REF http://www.openwall.com/lists/oss-security/2026/06/06/4 REF https://metacpan.org/release/HMBRAND/DBI-1.648/changes

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy