Skip to main content

Perl DBI CVE-2026-9698

| EUVDEUVD-2026-35366 CRITICAL
Out-of-bounds Write (CWE-787)
2026-06-09 CPANSec GHSA-83j7-3c78-fq8j
Buffer Overflow Memory Corruption Dbi Hmbrand
9.8
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Identify Perl app reflecting DB errors
  2. Delivery
    Craft input producing oversized DB error string
  3. Exploit
    Trigger DBI error handler (RaiseError/PrintError/HandleError)
  4. Execution
    Overflow 200-byte stack buffer in XS_DBI_dispatch
  5. Persist
    Overwrite saved return address
  6. Impact
    Execute arbitrary code in Perl process

Vulnerability Assessment

Weakness
CWE
CWE-787
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK

2 techniques across 2 tactics: Execution, Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

The application must have at least one of DBI's error handlers enabled - RaiseError, PrintError, or HandleError - which is the default and standard configuration for nearly all Perl database code. The attacker must additionally have a path to influence the text content of a database error message processed by DBI's dispatch routine, typically by injecting input that the database server echoes into an error string (e.g., invalid identifier names, constraint violation values, or syntax-error fragments returned by the DB). Exploitation is limited by the need for app-specific data flow from attacker input into a DBI-triggered error, by modern stack-overflow mitigations (stack canaries, ASLR, non-executable stacks) in the Perl interpreter binary, and by the requirement that the combined formatted string exceed 200 bytes.
Impact

Signals strongly conflict here. The CVSS 9.8 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) implies trivial remote unauthenticated RCE, but the description and code path require an attacker to influence error message text - a precondition that depends entirely on application design and is not network-reachable by default. EPSS (0.02%, 4th percentile) and the absence of any KEV listing or public exploit code support the view that real-world exploitability is far lower than the CVSS suggests. SSVC-style assessment: exploitation is not automatable (requires app-specific injection paths into DBI error strings), technical impact is total (stack overflow in a C extension can yield RCE), but exposure is constrained. Practically: prioritize patching for any Perl service that exposes DBI errors derived from untrusted input (e.g., reflected DB errors in web apps), but this is not a drop-everything emergency for typical hardened deployments.
Exploit ScenarioDerived

An attacker submits crafted input to a Perl web application (e.g., a search parameter inserted into a SQL statement) chosen to provoke a database error whose message text - controlled in part by the attacker's input echoed back by the database - exceeds 200 bytes when combined with the implementor class and method name. When DBI's dispatch routine formats the error header with unbounded sprintf into the stack buffer, the return address is overwritten, potentially yielding arbitrary code execution in the Perl process. No public exploit identified at time of analysis, and successful weaponization would require defeating modern stack protections (canaries, ASLR, NX).
Act Now Prioritize within 24-48h. Why: CRITICAL severity.
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 09, 2026

Stack-based buffer overflow in Perl DBI module versions prior to 1.648 allows attackers who can influence database error message content to corrupt memory via a fixed 200-byte stack buffer used during error formatting. The flaw is triggered when applications enable RaiseError, PrintError, or HandleError handlers - a near-universal configuration in production Perl database code. No public exploit identified at time of analysis, and EPSS rates exploitation probability at just 0.02% despite the CVSS 9.8 rating.

RemediationAI

Vendor-released patch: DBI 1.648 (released 2025-05-27 by H.Merijn Brand). Upgrade via CPAN with cpan DBI or cpanm DBI@1.648, or install the distribution-packaged version once your OS vendor backports the fix; the upstream commit is at https://github.com/perl5-dbi/dbi/commit/bfe5d73c162d2d1f761a639a0aa33aad6a9eb54e and the oss-security advisory at https://seclists.org/oss-sec/2026/q2/855. As compensating controls until upgrade, audit application error handlers to ensure database error strings derived from user input are not reflected back through DBI's RaiseError/PrintError/HandleError paths, and consider replacing RaiseError with a custom HandleError callback that sanitizes or truncates inputs before DBI's internal formatter runs - the trade-off is loss of DBI's standard error prefix formatting and potentially altered exception messages for application monitoring.

Affected VersionsENISA

DBI 0 <1.648

Affected Packages

euvd dbi fix: 1.648

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

DBI (Database Independent Interface) is the foundational database abstraction layer used by virtually all Perl applications that interact with databases (DBD::mysql, DBD::Pg, DBD::SQLite, DBD::Oracle, etc.). The root cause is CWE-787 (Out-of-bounds Write): in DBI.xs the XS_DBI_dispatch function declared a fixed 200-byte stack buffer (char intro[200]) and used unbounded sprintf to format an error message header containing the implementor class name, method name, and status text. Because the implementor stash name (HvNAME) and method name are concatenated without a length check, a sufficiently long identifier or error-context string overflows the stack frame. The fix replaces the stack buffer with newSVpvf, which allocates a properly sized Perl SV on the heap.

Know when Dbi gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SUSE 7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat 8.2 HIGH

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
CVSS changed
Jun 09, 2026 - 17:22 NVD
9.8 (CRITICAL)
CVE Published
Jun 09, 2026 - 07:22 nvd
UNKNOWN (no severity yet)

DescriptionNVD

DBI versions before 1.648 for Perl saved errors in a limited-sized buffer.

Error messages that were returned when RaiseError, PrintError or HandleError were set were written to a 200-byte buffer without a length limit.

Attackers that can influence the error text in an application can trigger a buffer overflow.

Executive ViewAI

Why It Matters

The Perl DBI module (versions before 1.648) contains a critical memory corruption vulnerability affecting any Perl application using database error handlers-standard in production environments. Exploitation could enable unauthorized code execution with database application privileges. Although no public exploits have been identified, the widespread reliance on Perl DBI makes timely patching essential.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.0%
Top 96% exploitable
Social Media
1
Sightings
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment MSRC Vendor CIRCL GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
CRITICAL severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
High
Technical Impact
Partial

Priority Score

49
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +49
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

More in Dbi

View all
CVE-2026-14739 CRITICAL
9.8 Jul 07

Heap out-of-bounds write in the Perl DBI database-interface module before version 1.650 occurs when DBI preparses a SQL

CVE-2026-15043 CRITICAL
9.8 Jul 14

Incorrect WHERE-clause evaluation in Perl's DBI::SQL::Nano (versions 1.42 up to 1.651) causes text-based '<=' and '>=' c
CVE-2026-10879 CRITICAL
9.8 Jun 05

Heap buffer overflow in the Perl DBI module versions before 1.648 occurs when the preparse() function processes SQL stat
CVE-2026-60082 CRITICAL
9.1 Jul 14

Out-of-bounds read in the Perl DBI (Database Independent Interface) module before version 1.651 lets a caller trigger a

CVE-2026-14740 CRITICAL
9.1 Jul 07

Out-of-bounds read in the Perl DBI module's preparse() SQL-normalisation routine allows an attacker who controls SQL pas
CVE-2026-14380 HIGH
8.8 Jul 07

Arbitrary Perl code execution in the DBI database-interface module (versions before 1.650) allows attackers who influenc
CVE-2026-60081 HIGH
7.5 Jul 14

Memory-exhaustion denial of service in the DBI::ProfileData module (bundled with Perl DBI) before version 1.651 allows a

Same weakness CWE-787 – Out-of-bounds Write

View all
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2012-1889 HIGH POC
8.8
CVE-2010-3333 HIGH POC
7.8
CVE-2014-1761 HIGH POC
7.8
CVE-2009-3129 HIGH POC
7.8
CVE-2021-1732 HIGH POC
7.8
CVE-2013-3346 CRITICAL POC
9.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected

References

Advisories & patches
PATCH https://github.com/perl5-dbi/dbi/commit/bfe5d73c162d2d1f761a639a0aa33aad6a9eb54e.patch ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-9698 ADVISORY https://seclists.org/oss-sec/2026/q2/855 ADVISORY https://ubuntu.com/security/notices/USN-8466-1 ADVISORY https://vuldb.com/vuln/369469 REF http://www.openwall.com/lists/oss-security/2026/06/09/9 REF https://access.redhat.com/errata/RHSA-2026:38512 REF https://access.redhat.com/errata/RHSA-2026:38513 REF https://access.redhat.com/errata/RHSA-2026:38901 REF https://access.redhat.com/errata/RHSA-2026:53371 REF https://access.redhat.com/errata/RHSA-2026:62667 REF https://access.redhat.com/security/cve/CVE-2026-9698 REF https://bugzilla.redhat.com/show_bug.cgi?id=2486734 REF https://metacpan.org/release/HMBRAND/DBI-1.648/changes REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-9698.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy