What’s Vulnerable › Vulnerabilities

CVE-2026-10879: DBI versions before 1.648 for Perl have a heap overflow when preparsing SQL statements with more than 9 binders

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-05 · updated 2026-10-26
• Weakness: CWE-787

Description

DBI versions before 1.648 for Perl have a heap overflow when preparsing SQL statements with more than 9 binders. The preparse method expands SQL placeholder characters to numbered binders of the form :pN, but only allocates three characters per binder in the buffer. Placeholders 10-99 require four characters, 100-999 require five characters, et cetera.

Affected products

• HMBRAND DBI: before 1.648 — fixed in 1.648

How to fix

Upgrade to a fixed version: HMBRAND DBI 1.648. Check the vendor advisory for mitigations.

References

• https://github.com/perl5-dbi/dbi/commit/af79036c07aa9a457971c0f4136e37c85dc20978.patch
• https://metacpan.org/release/HMBRAND/DBI-1.648/changes
• http://www.openwall.com/lists/oss-security/2026/06/06/4

Get alerted when CVE-2026-10879 or the next vulnerability affects your stack