Skip to main content

Perl DBI CVE-2026-14740

CRITICAL
Out-of-bounds Read (CWE-125)
2026-07-07 CPANSec
Buffer Overflow Information Disclosure Dbi Hmbrand
Critical
Disputed · 9.1 Vendor: CPANSec
Share

Severity by source

Sources disagree (Medium–Critical)
Vendor (CPANSec) PRIMARY
9.1 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
vuln.today AI
4.8 MEDIUM

AC:H because it needs comment-leading SQL reaching preparse() and a hardened build to fault; C:L (one nondeterministic byte, not H) and A:L (crash only on hardened builds).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE
6.5 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Red Hat
5.0 MEDIUM
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: CPANSec

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

Lifecycle Timeline

3
Analysis Generated
Jul 08, 2026 - 14:24 vuln.today
CVSS changed
Jul 08, 2026 - 14:22 NVD
9.1 (CRITICAL)
CVE Published
Jul 07, 2026 - 22:05 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

DBI versions before 1.650 for Perl read one byte out-of-bounds in preparse when deleting an initial SQL comment.

The preparse method normalises SQL and removes comments. When the SQL starts with a comment line, the deletion of that line during normalisation led to an out-of-bounds read by one byte. The result is a fault on memory-hardened builds and nondeterministic newline retention on normal builds.

AnalysisAI

Out-of-bounds read in the Perl DBI module's preparse() SQL-normalisation routine allows an attacker who controls SQL passed to the method (where the statement begins with a comment line) to trigger a one-byte read past a buffer, in all DBI releases before 1.650. On memory-hardened builds this faults and crashes the process (availability impact); on normal builds it produces nondeterministic newline retention. This is a CWE-125 flaw reported by CPANSec with no public exploit identified at time of analysis; EPSS is low at 0.19% (8th percentile) and it is not in CISA KEV.

Technical ContextAI

DBI (Database Interface) is the de-facto standard database-access abstraction layer for Perl, sitting between Perl applications and DBD driver backends (DBD::mysql, DBD::Pg, DBD::SQLite, etc.). The affected code is the preparse() method, a helper that normalises SQL statements and strips comments before further processing. When a supplied statement starts with an initial SQL comment line, the logic that deletes that leading comment during normalisation advances one byte beyond the end of the string buffer, an out-of-bounds read classified as CWE-125 (Out-of-Bounds Read). Because the over-read lands on adjacent heap memory, the effect is environment-dependent: hardening instrumentation (ASan, hardened malloc, guard pages) turns the invalid read into a fault, while ordinary builds silently mis-handle the trailing newline. The CPE identifies the affected package as cpe:2.3:a:hmbrand:dbi (HMBRAND is the current CPAN maintainer namespace for the DBI-1.650 release).

RemediationAI

Vendor-released patch: DBI 1.650 - upgrade the Perl DBI module to 1.650 or later from CPAN (cpan DBI or via your OS/vendor package channel); the upstream fix is commit fc16f9e8b3dd5c65caf1867781ab2bfe2fadcc01 (https://github.com/perl5-dbi/dbi/commit/fc16f9e8b3dd5c65caf1867781ab2bfe2fadcc01.patch) referenced in advisory GHSA-35f4-f8m9-w8xg. Because DBI is a foundational dependency, rebuild or reinstall any bundled/vendored copies (e.g. inside application containers, fatpacked scripts, or system Perl) and verify with perl -MDBI -e 'print $DBI::VERSION'. If immediate upgrade is not possible, the concrete compensating control is to avoid passing untrusted or externally-influenced SQL directly to DBI's preparse() method - sanitise or strip leading SQL comments before calling preparse(), or route such input through code paths that do not invoke it; the trade-off is that you must audit application code to confirm where preparse() is used, and comment-stripping changes SQL normalisation behaviour. On memory-hardened deployments where the fault causes crashes, expect a stability (DoS) impact until patched.

More in Dbi

View all
CVE-2026-14739 CRITICAL
9.8 Jul 07

Heap out-of-bounds write in the Perl DBI database-interface module before version 1.650 occurs when DBI preparses a SQL

CVE-2026-15043 CRITICAL
9.8 Jul 14

Incorrect WHERE-clause evaluation in Perl's DBI::SQL::Nano (versions 1.42 up to 1.651) causes text-based '<=' and '>=' c
CVE-2026-10879 CRITICAL
9.8 Jun 05

Heap buffer overflow in the Perl DBI module versions before 1.648 occurs when the preparse() function processes SQL stat
CVE-2026-9698 CRITICAL
9.8 Jun 09

Stack-based buffer overflow in Perl DBI module versions prior to 1.648 allows attackers who can influence database error
CVE-2026-60082 CRITICAL
9.1 Jul 14

Out-of-bounds read in the Perl DBI (Database Independent Interface) module before version 1.651 lets a caller trigger a

CVE-2026-14380 HIGH
8.8 Jul 07

Arbitrary Perl code execution in the DBI database-interface module (versions before 1.650) allows attackers who influenc
CVE-2026-60081 HIGH
7.5 Jul 14

Memory-exhaustion denial of service in the DBI::ProfileData module (bundled with Perl DBI) before version 1.651 allows a

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected

Share

CVE-2026-14740 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy