Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-14739: Perl DBI before 1.650 can crash with many placeholders
CVE-2026-14739 · published 4 months ago
Summary
Older versions of the Perl DBI library (such as the debian/libdbi-perl, bellsoft/perl-dbi, hmbrand/dbi, debian/rootio-libdbi-perl and libdbi-perl packages) may run out of memory when a SQL statement contains an extremely large number of placeholders, leading to a program crash. This can interrupt applications that build dynamic queries with many parameters. Upgrade the DBI package to version 1.650 or later, which limits placeholders to a safe maximum and prevents the overflow.
What to do
- Update bellsoft perl-dbi to version 1.651-r0.
- Update bellsoft perl-dbi to version 1.650-r0.
- Update debian libdbi-perl to version 1.643-4+deb12u1.aikido.1.
- Update debian rootio-libdbi-perl to version 1.643-4+deb12u1.aikido.1.
- Update libdbi-perl to version 1.643-4+deb12u1.aikido.2.
- Update rootio-libdbi-perl to version 1.643-4+deb12u1.aikido.2.
- Update debian libdbi-perl to version 1.643-4+deb12u2.
- Update debian libdbi-perl to version 1.652-2~deb13u1.
- Update debian libdbi-perl to version 1.650-1.
- Update perl-dbi to version 1.651-r0.
- Update hmbrand dbi to version 1.650 or later.
- Update perl dbi to version 1.650 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:14 | debian | libdbi-perl |
< 1.650-1 Fix: upgrade to 1.650-1
|
| Alpaquita:25 | bellsoft | perl-dbi |
>= 1.647-r0, < 1.651-r0 Fix: upgrade to 1.651-r0
|
| Alpaquita:stream | bellsoft | perl-dbi |
>= 1.643-r3, < 1.650-r0 Fix: upgrade to 1.650-r0
|
| – | hmbrand | dbi | < 1.650 |
| Debian:11 | debian | libdbi-perl | All versions |
| Debian:12 | debian | libdbi-perl |
< 1.643-4+deb12u2 Fix: upgrade to 1.643-4+deb12u2
|
| Debian:13 | debian | libdbi-perl |
< 1.652-2~deb13u1 Fix: upgrade to 1.652-2~deb13u1
|
| Alpaquita:23 | bellsoft | perl-dbi |
>= 1.643-r4, < 1.651-r0 Fix: upgrade to 1.651-r0
|
| Root:Debian:12 | debian | libdbi-perl |
< 1.643-4+deb12u1.aikido.1 Fix: upgrade to 1.643-4+deb12u1.aikido.1
|
| Root:Debian:12 | debian | rootio-libdbi-perl |
< 1.643-4+deb12u1.aikido.1 Fix: upgrade to 1.643-4+deb12u1.aikido.1
|
| Root:Debian:12 | – | libdbi-perl |
< 1.643-4+deb12u1.aikido.2 Fix: upgrade to 1.643-4+deb12u1.aikido.2
|
| Root:Debian:12 | – | rootio-libdbi-perl |
< 1.643-4+deb12u1.aikido.2 Fix: upgrade to 1.643-4+deb12u1.aikido.2
|
| – | perl | dbi |
< 1.650 cpe:2.3:a:perl:dbi:*:*:*:*:*:*:*:* |
| Ubuntu:Pro:14.04:LTS | canonical | libdbi-perl | All versions |
| Alpine:v3.24 | – | perl-dbi |
< 1.651-r0 Fix: upgrade to 1.651-r0
|
Original advisory text
DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders
DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders.
The fix for CVE-2026-10879 did not allocate enough memory to handle approximately 1.2-million placeholders.
DBI version 1.650 sets a hard limit of 99,999 placeholders.
The fix for CVE-2026-10879 did not allocate enough memory to handle approximately 1.2-million placeholders.
DBI version 1.650 sets a hard limit of 99,999 placeholders.
References
- https://metacpan.org/release/HMBRAND/DBI-1.650/changes Vendor Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-10879 Vendor Advisory
- https://github.com/perl5-dbi/dbi/commit/2b77c88b655e9539a592c71a61fb965fc0075395... Patch
- https://security-tracker.debian.org/tracker/CVE-2026-14739 Vendor Advisory
- https://cpan.org/modules URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/14xxx/CVE-2026-14739... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-14739 Vendor Advisory
- https://github.com/perl5-dbi/dbi Product
- https://docs.bell-sw.com/security/cves/CVE-2026-14739 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-14739 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-14739 Third Party Advisory
- https://lists.security.metacpan.org/cve-announce/msg/41625530/ Third Party Advisory
- https://security.alpinelinux.org/vuln/CVE-2026-14739 Vendor Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Type
CWE-787Out-of-bounds Write
Timeline
Published7 Jul 2026
Updated4 Nov 2026
First seen7 Jul 2026
Sources
CVE-2026-14739 · NVD
CVE-2026-14739 · MITRE
DEBIAN-CVE-2026-14739 · OSV
CVE-2026-14739 · OSV
BELL-CVE-2026-14739 · OSV
UBUNTU-CVE-2026-14739 · OSV
ALPINE-CVE-2026-14739 · OSV
Track software like this
Free during beta