Skip to main content

Perl DBI CVE-2026-9698

| EUVDEUVD-2026-35366 CRITICAL
Out-of-bounds Write (CWE-787)
2026-06-09 CPANSec GHSA-83j7-3c78-fq8j
Memory Corruption Buffer Overflow Dbi
9.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SUSE
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat
8.2 HIGH
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
Source Code Evidence Fetched
Jun 09, 2026 - 17:22 vuln.today
Analysis Generated
Jun 09, 2026 - 17:22 vuln.today
CVSS changed
Jun 09, 2026 - 17:22 NVD
9.8 (CRITICAL)
CVE Published
Jun 09, 2026 - 07:22 nvd
UNKNOWN (no severity yet)

DescriptionNVD

DBI versions before 1.648 for Perl saved errors in a limited-sized buffer.

Error messages that were returned when RaiseError, PrintError or HandleError were set were written to a 200-byte buffer without a length limit.

Attackers that can influence the error text in an application can trigger a buffer overflow.

AnalysisAI

Stack-based buffer overflow in Perl DBI module versions prior to 1.648 allows attackers who can influence database error message content to corrupt memory via a fixed 200-byte stack buffer used during error formatting. The flaw is triggered when applications enable RaiseError, PrintError, or HandleError handlers - a near-universal configuration in production Perl database code. No public exploit identified at time of analysis, and EPSS rates exploitation probability at just 0.02% despite the CVSS 9.8 rating.

Technical ContextAI

DBI (Database Independent Interface) is the foundational database abstraction layer used by virtually all Perl applications that interact with databases (DBD::mysql, DBD::Pg, DBD::SQLite, DBD::Oracle, etc.). The root cause is CWE-787 (Out-of-bounds Write): in DBI.xs the XS_DBI_dispatch function declared a fixed 200-byte stack buffer (char intro[200]) and used unbounded sprintf to format an error message header containing the implementor class name, method name, and status text. Because the implementor stash name (HvNAME) and method name are concatenated without a length check, a sufficiently long identifier or error-context string overflows the stack frame. The fix replaces the stack buffer with newSVpvf, which allocates a properly sized Perl SV on the heap.

RemediationAI

Vendor-released patch: DBI 1.648 (released 2025-05-27 by H.Merijn Brand). Upgrade via CPAN with cpan DBI or cpanm DBI@1.648, or install the distribution-packaged version once your OS vendor backports the fix; the upstream commit is at https://github.com/perl5-dbi/dbi/commit/bfe5d73c162d2d1f761a639a0aa33aad6a9eb54e and the oss-security advisory at https://seclists.org/oss-sec/2026/q2/855. As compensating controls until upgrade, audit application error handlers to ensure database error strings derived from user input are not reflected back through DBI's RaiseError/PrintError/HandleError paths, and consider replacing RaiseError with a custom HandleError callback that sanitizes or truncates inputs before DBI's internal formatter runs - the trade-off is loss of DBI's standard error prefix formatting and potentially altered exception messages for application monitoring.

More in Dbi

View all
CVE-2026-14739 CRITICAL
9.8 Jul 07

Heap out-of-bounds write in the Perl DBI database-interface module before version 1.650 occurs when DBI preparses a SQL

CVE-2026-10879 CRITICAL
9.8 Jun 05

Heap buffer overflow in the Perl DBI module versions before 1.648 occurs when the preparse() function processes SQL stat
CVE-2026-15043 CRITICAL
9.8 Jul 14

Incorrect WHERE-clause evaluation in Perl's DBI::SQL::Nano (versions 1.42 up to 1.651) causes text-based '<=' and '>=' c
CVE-2026-14740 CRITICAL
9.1 Jul 07

Out-of-bounds read in the Perl DBI module's preparse() SQL-normalisation routine allows an attacker who controls SQL pas
CVE-2026-60082 CRITICAL
9.1 Jul 14

Out-of-bounds read in the Perl DBI (Database Independent Interface) module before version 1.651 lets a caller trigger a

CVE-2026-14380 HIGH
8.8 Jul 07

DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile. When a string is ass
CVE-2026-60081 HIGH
7.5 Jul 14

Memory-exhaustion denial of service in the DBI::ProfileData module (bundled with Perl DBI) before version 1.651 allows a

Same weakness CWE-787 – Out-of-bounds Write

View all
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2012-1889 HIGH POC
8.8
CVE-2010-3333 HIGH POC
7.8
CVE-2014-1761 HIGH POC
7.8
CVE-2009-3129 HIGH POC
7.8
CVE-2021-1732 HIGH POC
7.8
CVE-2013-3346 CRITICAL POC
9.8

Same technique Memory Corruption

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2010-3333 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected

Share

CVE-2026-9698 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy