Skip to main content

Perl DBI CVE-2026-60082

| EUVDEUVD-2026-43729 CRITICAL
Out-of-bounds Read (CWE-125)
2026-07-14 CPANSec
Buffer Overflow Information Disclosure Dbi Red Hat Suse
Critical
Disputed · 9.1 Vendor: CPANSec
Share

Severity by source

Sources disagree (Medium–Critical)
Vendor (CPANSec) PRIMARY
9.1 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
vuln.today AI
7.4 HIGH

AC:H because the trigger needs the specific zero-field/non-empty-row inconsistency from an untrusted driver or backend; C:H and A:H for memory disclosure and process crash, I:N as no integrity impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
4.0 MEDIUM
AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Red Hat
3.3 MEDIUM
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: CPANSec

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

Lifecycle Timeline

5
Source Code Evidence Fetched
Jul 15, 2026 - 15:24 vuln.today
Analysis Generated
Jul 15, 2026 - 15:24 vuln.today
CVSS changed
Jul 15, 2026 - 15:22 NVD
9.1 (CRITICAL)
CVE Published
Jul 14, 2026 - 15:35 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 14, 2026 - 15:35 cve.org
CRITICAL 9.1

DescriptionCVE.org

DBI versions before 1.651 for Perl do not enforce statement handle consistency with the row.

When the statement handle had no fields but the source row was non-empty, the internal row-buffer helper would read from a negative array index.

This could be triggered by a caller supplying inconsistent metadata and rows to the prepare method.

AnalysisAI

Out-of-bounds read in the Perl DBI (Database Independent Interface) module before version 1.651 lets a caller trigger a negative-array-index read inside the internal row-buffer helper (_set_fbav in DBI.xs), potentially disclosing adjacent process memory or crashing the interpreter. The flaw arises when a statement handle declares zero fields but is fed a non-empty source row, an inconsistency the module failed to reject before returning results. No public exploit has been identified at time of analysis and the issue is not on CISA KEV; the assigned CVSS of 9.1 reflects high confidentiality and availability impact under a network vector, but realistic exploitation depends on a caller (typically a DBD driver or database backend) supplying mismatched metadata and rows.

Technical ContextAI

DBI is the standard database abstraction layer for Perl; virtually every Perl application that talks to a database (via DBD::mysql, DBD::Pg, DBD::SQLite, DBD::ODBC, etc.) routes result rows through DBI's C-level (XS) core. The vulnerable routine _set_fbav copies a source row into the statement handle's field-buffer array vector (fbav). The root cause is CWE-125 (Out-of-bounds Read): when the statement handle reports dst_fields 0 but the incoming source row is non-empty, the helper computes an index into the destination buffer that underflows to a negative offset, reading memory outside the intended array. The upstream fix (commit 397868704291bbf0989b97e2c0661189890653e2, released in 1.651) adds an explicit guard that croaks when dst_fields 0, enforcing consistency between the statement handle's declared field count and the row actually supplied.

RemediationAI

Upgrade to DBI 1.651 or later, which enforces field-count consistency and rejects a zero-field statement handle paired with a non-empty row (Vendor-released patch: DBI 1.651). The fix is commit 397868704291bbf0989b97e2c0661189890653e2 (https://github.com/perl5-dbi/dbi/commit/397868704291bbf0989b97e2c0661189890653e2.patch); install the patched CPAN release via your package manager or cpanm DBI@1.651. Because DBI is a shared dependency, rebuild or re-test applications and any XS-based DBD drivers against the new version. If you cannot upgrade immediately, the practical compensating control is to avoid trusting untrusted or unstable DBD drivers and untrusted database backends that could return inconsistent field metadata, and to run Perl database workloads under process isolation so an out-of-bounds read that crashes the interpreter cannot take down co-located services; note these controls reduce blast radius but do not close the underlying memory-safety bug, so treat them as temporary. Consult GHSA-rwhc-hhmv-cjvg and the oss-security advisory (https://seclists.org/oss-sec/2026/q3/143) for vendor guidance.

More in Dbi

View all
CVE-2026-14739 CRITICAL
9.8 Jul 07

Heap out-of-bounds write in the Perl DBI database-interface module before version 1.650 occurs when DBI preparses a SQL

CVE-2026-15043 CRITICAL
9.8 Jul 14

Incorrect WHERE-clause evaluation in Perl's DBI::SQL::Nano (versions 1.42 up to 1.651) causes text-based '<=' and '>=' c
CVE-2026-10879 CRITICAL
9.8 Jun 05

Heap buffer overflow in the Perl DBI module versions before 1.648 occurs when the preparse() function processes SQL stat
CVE-2026-9698 CRITICAL
9.8 Jun 09

Stack-based buffer overflow in Perl DBI module versions prior to 1.648 allows attackers who can influence database error
CVE-2026-14740 CRITICAL
9.1 Jul 07

Out-of-bounds read in the Perl DBI module's preparse() SQL-normalisation routine allows an attacker who controls SQL pas
CVE-2026-14380 HIGH
8.8 Jul 07

Arbitrary Perl code execution in the DBI database-interface module (versions before 1.650) allows attackers who influenc
CVE-2026-60081 HIGH
7.5 Jul 14

Memory-exhaustion denial of service in the DBI::ProfileData module (bundled with Perl DBI) before version 1.651 allows a

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Leap 16.0 Fixed
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Affected

Share

CVE-2026-60082 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy