Skip to content
OpenAdvisories
Critical · 9.1 CVE-2026-73194 EUVD-2026-59745

DBI versions before 1.652 for Perl allow a heap out-of-bounds write via an unvalidated numeric placeholder that sets the binder counter in preparse

Published Aug 15, 2026 · Updated Aug 17, 2026 · Assigned by CPANSec

Package: libdbi-perl Package: libdbi-perl Package: perl-DBI Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Ubuntu

Description

DBI versions before 1.652 for Perl allow a heap out-of-bounds write via an unvalidated numeric placeholder that sets the binder counter in preparse.

preparse reserves seven output bytes per input byte, the width of the longest ':p99999' expansion. The ':N' branch parses the number with `atoi(src)` and assigns it to the binder counter with no range check, so a statement containing ':2147483648' leaves the counter negative (-2147483648 with glibc, where atoi wraps). Each following '?' then expands through `sprintf(start, ":p%d", idx++)` to ':p-2147483648', 14 bytes with the terminating NUL where the buffer budgets 7. The placeholder limit added in 1.650 tests the counter against 99,999, which a negative counter passes.

Any caller that preparses an untrusted statement into ':pN' style placeholders gets a heap out-of-bounds write that grows with the number of '?' marks following the poisoned placeholder. The '?' and '%s' return styles compare the parsed number against the expected sequence and error out, and are unaffected.

Affected products

VendorProductAffectedFixed
— DBI < 1.652 1.652

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 libdbi-perl 1.652-1 —
Debian 13 libdbi-perl 1.652-2~deb13u1 —
Debian 12 libdbi-perl 1.643-4+deb12u2 —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.04 LTS libdbi-perl 1.647-1ubuntu0.26.04.3 USN-8841-1
Ubuntu 24.04 LTS libdbi-perl 1.643-4ubuntu0.3 USN-8841-1
Ubuntu 22.04 LTS libdbi-perl 1.643-3ubuntu0.3 USN-8841-1
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 20.04 LTS libdbi-perl 1.643-1ubuntu0.1+esm3 USN-8841-1
Ubuntu Pro 18.04 LTS libdbi-perl 1.640-1ubuntu0.3+esm3 USN-8841-1
Ubuntu Pro 16.04 LTS libdbi-perl 1.634-1ubuntu0.2+esm4 USN-8841-1
Ubuntu Pro 14.04 LTS libdbi-perl 1.630-1ubuntu0.1~esm8 USN-8841-1

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 10 perl-DBI 1.643-26.el10_2.6 RHSA-2026:70753
RHEL 9 perl-DBI 1.643-9.el9_8.6 RHSA-2026:71422
RHEL 8 perl-DBI 1.641-3.el8_10 RHSA-2026:71608, RHSA-2026:69112

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 perl-DBI 1.643-26.el10_2.6 ALSA-2026:70753
AlmaLinux 9 perl-DBI 1.643-9.el9_8.6 ALSA-2026:71422
AlmaLinux 8 perl-DBI 1.641-3.el8_10 ALSA-2026:71608, ALSA-2026:69112

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 perl-DBI 1.643-26.el10_2.6 RLSA-2026:70753
Rocky Linux 9 perl-DBI 1.643-9.el9_8.6 RLSA-2026:71422
Rocky Linux 8 perl-DBI 1.641-3.el8_10 RLSA-2026:71608, RLSA-2026:69112

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed perl-DBI 1.653.0-1.1 openSUSE-SU-2026:11754-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 perl-DBI +1 1.652-1.amzn2023.0.1 ALAS2023-2026-2075
Amazon Linux 2 perl-DBI 1.627-4.amzn2.0.7 ALAS2-2026-3871

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 perl-DBI 1.652-1 —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 10 perl-DBI 1.643-26.el10_2.6 ELSA-2026-70753
Oracle Linux 9 perl-DBI 1.643-9.el9_8.6 ELSA-2026-71422
Oracle Linux 8 perl-DBI 1.641-3.el8_10 ELSA-2026-71608, ELSA-2026-69112

Advisories 22

References