Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-14739: Perl DBI versions before 1.650 allow SQL data overflow
CVE-2026-14739
CVE-2026-14739
Summary
Perl's DBI database interface is vulnerable to a data overflow when handling SQL statements with a very large number of placeholders. This could potentially allow an attacker to crash the system or execute malicious code. To fix this issue, update to DBI version 1.650 or later.
What to do
No fix is available yet. Check with your software vendor for updates.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| hmbrand | dbi | < 1.650 |
Original title
DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders.
The fix for CVE-2026-10879 did not allocate enough memory to handle a...
Original description
DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders.
The fix for CVE-2026-10879 did not allocate enough memory to handle approximately 1.2-million placeholders.
DBI version 1.650 sets a hard limit of 99,999 placeholders.
The fix for CVE-2026-10879 did not allocate enough memory to handle approximately 1.2-million placeholders.
DBI version 1.650 sets a hard limit of 99,999 placeholders.
Vulnerability type
CWE-787
Out-of-bounds Write
- https://github.com/perl5-dbi/dbi/commit/2b77c88b655e9539a592c71a61fb965fc0075395... patch
- https://www.cve.org/CVERecord?id=CVE-2026-10879 vendor-advisory related
- https://metacpan.org/release/HMBRAND/DBI-1.650/changes release-notes
Published: 7 Jul 2026 · Updated: 23 Jul 2026 · First seen: 7 Jul 2026