Skip to main content

Dbi CVE-2026-15043

| EUVDEUVD-2026-43654 CRITICAL
Use of Incorrect Operator (CWE-480)
2026-07-14 CPANSec
Information Disclosure Dbi Hmbrand
Critical
Disputed · 9.8 Vendor: CPANSec
View

Vulnerability Assessment

Weakness
CWE
CWE-480
ASVS 5.0
V15 - Secure Coding and Architecture Use of incorrect operator
Act Now Prioritize within 24-48h. Why: CRITICAL severity.
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 14, 2026

Incorrect WHERE-clause evaluation in Perl's DBI::SQL::Nano (versions 1.42 up to 1.651) causes text-based '<=' and '>=' comparisons to be silently inverted, so range-filtered queries return the wrong set of rows. The flaw affects DBI's built-in fallback mini-SQL engine used by file-backed drivers (DBD::File, DBD::DBM, CSV-style) when SQL::Statement is absent, and applications that rely on such predicates for policy or authorization filtering may leak or mishandle records without any error. There is no public exploit identified at time of analysis and the issue is not in CISA KEV; the fix is available upstream in DBI 1.651.

Affected VersionsENISA

DBI::SQL::Nano 1.42 <1.651

Affected Packages

euvd dbi_sql_nano fix: 1.651

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check

Know when Dbi gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Medium–Critical)
Vendor (CPANSec) PRIMARY 9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SUSE 5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Red Hat 4.3 MEDIUM

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: CPANSec

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

3
CVSS changed
Jul 14, 2026 - 15:22 NVD
9.8 (CRITICAL)
CVE Published
Jul 14, 2026 - 09:44 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 14, 2026 - 09:44 cve.org
CRITICAL 9.8

DescriptionCVE.org

DBI::SQL::Nano versions from 1.42 before 1.651 for Perl have inverted <= and >= SQL operators on text.

DBI::SQL::Nano, DBI's built-in mini-SQL engine, evaluated WHERE predicates incorrectly in some cases. In the non-numeric string branch of the is_matched method, <= was evaluated using Perl's ge operator, and >= was evaluated using Perl's le operator.

SQL::Nano is the fallback query engine for DBI's file-backed drivers (DBD::File, DBD::DBM, CSV-style drivers) whenever SQL::Statement is not installed, and is forced whenever DBI_SQL_NANO=1. Queries over such tables use these predicates directly.

The impact depends on the context. Where an application relies on a WHERE clause to filter file-backed data for policy or authorization, an inverted <=/>= comparison silently returns the wrong rows.

Executive ViewAI

Why It Matters

DBI (Perl Database Interface) versions 1.42-1.650 contain a WHERE-clause evaluation logic error that silently inverts comparison operators (<= and >=), causing range-filtered database queries to return incorrect record sets. Applications relying on such filters for authorization or policy enforcement risk exposing sensitive records or mishandling restricted data without triggering any error. This affects all applications using DBI's fallback SQL engine with file-backed databases (CSV, DBM, File drivers) when SQL::Statement is not installed.

Recommended Action

Within 24 hours, inventory all systems and applications running Perl DBI and document current versions, prioritizing those handling sensitive or restricted data. Within 7 days, plan and execute testing of DBI upgrade to version 1.651 in a staging environment, validating that range-based WHERE clauses return correct record sets. Within 30 days, deploy DBI 1.651 across all production systems and file-backed database applications, and conduct spot audits of historically filtered queries to confirm correct behavior restoration.

Business Impact: Severe
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.2%
Top 92% exploitable
Social Media
2
Sightings
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment MSRC Vendor CIRCL GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
CRITICAL severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Out-of-Cycle
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
Very High
Technical Impact
Total

Priority Score

49
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +49
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in Dbi

View all
CVE-2026-14739 CRITICAL
9.8 Jul 07

Heap out-of-bounds write in the Perl DBI database-interface module before version 1.650 occurs when DBI preparses a SQL

CVE-2026-10879 CRITICAL
9.8 Jun 05

Heap buffer overflow in the Perl DBI module versions before 1.648 occurs when the preparse() function processes SQL stat
CVE-2026-9698 CRITICAL
9.8 Jun 09

Stack-based buffer overflow in Perl DBI module versions prior to 1.648 allows attackers who can influence database error
CVE-2026-60082 CRITICAL
9.1 Jul 14

Out-of-bounds read in the Perl DBI (Database Independent Interface) module before version 1.651 lets a caller trigger a

CVE-2026-14740 CRITICAL
9.1 Jul 07

Out-of-bounds read in the Perl DBI module's preparse() SQL-normalisation routine allows an attacker who controls SQL pas
CVE-2026-14380 HIGH
8.8 Jul 07

Arbitrary Perl code execution in the DBI database-interface module (versions before 1.650) allows attackers who influenc
CVE-2026-60081 HIGH
7.5 Jul 14

Memory-exhaustion denial of service in the DBI::ProfileData module (bundled with Perl DBI) before version 1.651 allows a

Same weakness CWE-480 – Use of Incorrect Operator

View all
CVE-2022-1947 MEDIUM POC
6.5
CVE-2026-43114 CRITICAL
9.4
CVE-2026-48497 HIGH
7.5
CVE-2026-4748 HIGH
7.5
CVE-2026-79643 HIGH
7.3
CVE-2026-44722 MEDIUM
6.2
CVE-2025-52985 MEDIUM
5.3
CVE-2026-83525 LOW

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Affected

References

Advisories & patches
PATCH https://github.com/perl5-dbi/dbi/commit/e9742ef85a75867cbd696860e3bf3e32b681f98d.patch ADVISORY https://github.com/perl5-dbi/dbi/security/advisories/GHSA-mv45-ff6j-x9jp ADVISORY https://seclists.org/oss-sec/2026/q3/139 ADVISORY https://vuldb.com/vuln/378283 REF http://www.openwall.com/lists/oss-security/2026/07/14/9 REF https://metacpan.org/release/HMBRAND/DBI-1.651/changes

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy