CVE-2026-14739: DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-07 · updated 2026-10-25
Weakness: CWE-787

Description

DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders. The fix for CVE-2026-10879 did not allocate enough memory to handle approximately 1.2-million placeholders. DBI version 1.650 sets a hard limit of 99,999 placeholders.

Affected products

HMBRAND DBI: before 1.650 — fixed in 1.650

How to fix

Upgrade to a fixed version: HMBRAND DBI 1.650. Check the vendor advisory for mitigations.

References

https://github.com/perl5-dbi/dbi/commit/2b77c88b655e9539a592c71a61fb965fc0075395.patch
https://metacpan.org/release/HMBRAND/DBI-1.650/changes
https://www.cve.org/CVERecord?id=CVE-2026-10879

Get alerted when CVE-2026-14739 or the next vulnerability affects your stack