Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
Perl DBI Security Update: SQL Injection and Buffer Overflow Risk
published 4 months ago
Summary
Perl's DBI module has a security update to fix two issues that could allow attackers to inject malicious SQL code or overflow a buffer, potentially leading to unauthorized access or system crashes. This affects all Perl DBI versions before 1.648. We recommend updating to the latest version to ensure your database interactions are secure.
What to do
- Update openeuler perl-dbi to version 1.643-5.oe2203sp4.
- Update openeuler perl-dbi to version 1.643-5.oe2403sp1.
- Update openeuler perl-dbi to version 1.643-5.oe2403sp3.
- Update openeuler perl-dbi to version 1.643-4.oe2003sp4.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| openEuler:22.03-LTS-SP4 | openeuler | perl-dbi |
< 1.643-5.oe2203sp4 Fix: upgrade to 1.643-5.oe2203sp4
|
| openEuler:24.03-LTS-SP1 | openeuler | perl-dbi |
< 1.643-5.oe2403sp1 Fix: upgrade to 1.643-5.oe2403sp1
|
| openEuler:24.03-LTS-SP3 | openeuler | perl-dbi |
< 1.643-5.oe2403sp3 Fix: upgrade to 1.643-5.oe2403sp3
|
| openEuler:20.03-LTS-SP4 | openeuler | perl-dbi |
< 1.643-4.oe2003sp4 Fix: upgrade to 1.643-4.oe2003sp4
|
Original advisory text
perl-DBI security update
The DBI is the standard database interface module for Perl. It defines a set of methods, variables and conventions that provide a consistent database interface independent of the actual database being used. It is important to remember that the DBI is just an interface. The DBI is a layer of &quot;glue&quot; between an application and one or more database driver modules. It is the driver modules which do most of the real work. The DBI provides a standard interface and framework for the drivers to operate within.
Security Fix(es):
DBI versions before 1.648 for Perl have a heap overflow when preparsing SQL statements with more than 9 binders.
The preparse method expands SQL placeholder characters to numbered binders of the form :pN, but only allocates three characters per binder in the buffer. Placeholders 10-99 require four characters, 100-999 require five characters, et cetera.(CVE-2026-10879)
DBI versions before 1.648 for Perl saved errors in a limited-sized buffer.
Error messages that were returned when RaiseError, PrintError or HandleError were set were written to a 200-byte buffer without a length limit.
Attackers that can influence the error text in an application can trigger a buffer overflow.(CVE-2026-9698)
Security Fix(es):
DBI versions before 1.648 for Perl have a heap overflow when preparsing SQL statements with more than 9 binders.
The preparse method expands SQL placeholder characters to numbered binders of the form :pN, but only allocates three characters per binder in the buffer. Placeholders 10-99 require four characters, 100-999 require five characters, et cetera.(CVE-2026-10879)
DBI versions before 1.648 for Perl saved errors in a limited-sized buffer.
Error messages that were returned when RaiseError, PrintError or HandleError were set were written to a 200-byte buffer without a length limit.
Attackers that can influence the error text in an application can trigger a buffer overflow.(CVE-2026-9698)
References
- https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-10879 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-9698 Vendor Advisory
Severity
9.8
Critical
Timeline
Published12 Jun 2026
Updated21 Aug 2026
First seen12 Jun 2026
Sources
OESA-2026-2684 · OSV
Track software like this
Free during beta