Description
DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in FetchHashKeyName.
fetchrow_hashref uses the string pointer of the FetchHashKeyName attribute as the key name without stringifying it first. When FetchHashKeyName has been set to an integer (IV) or floating-point (NV) value, that pointer is invalid, so reading the key name triggers a segmentation fault.
This can be triggered with the following code:
my $dbh = DBI->connect( "dbi:ExampleP:", "", "",
{ RaiseError => 0, PrintError => 0 } );
$dbh->{FetchHashKeyName} = 42;
my $sth = $dbh->prepare("select mode, size, name from .");
$sth->execute;
$sth->fetchrow_hashref;
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | DBI | < 1.654 | 1.654 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libdbi-perl | 1.654-1 | — |
| Debian 13 | libdbi-perl | No fix yet | — |
| Debian 12 | libdbi-perl | 1.643-4+deb12u3 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | libdbi-perl | No fix yet | — |
| Ubuntu 26.04 LTS | libdbi-perl | 1.647-1ubuntu0.26.04.4 | USN-8912-1 |
| Ubuntu 24.04 LTS | libdbi-perl | 1.643-4ubuntu0.4 | USN-8912-1 |
| Ubuntu 22.04 LTS | libdbi-perl | 1.643-3ubuntu0.4 | USN-8912-1 |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | libdbi-perl | 1.643-1ubuntu0.1+esm4 | USN-8912-1 |
| Ubuntu Pro 18.04 LTS | libdbi-perl | 1.640-1ubuntu0.3+esm4 | USN-8912-1 |
| Ubuntu Pro 16.04 LTS | libdbi-perl | 1.634-1ubuntu0.2+esm5 | USN-8912-1 |
| Ubuntu Pro 14.04 LTS | libdbi-perl | 1.630-1ubuntu0.1~esm9 | USN-8912-1 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | perl-DBI | 1.647.0-150600.12.26.1 | SUSE-SU-2026:4805-1 |
| SLES 15 SP5 | perl-DBI | 1.642-150200.3.26.1 | SUSE-SU-2026:4612-1 |
| SLES 15 SP4 | perl-DBI | 1.642-150200.3.26.1 | SUSE-SU-2026:4612-1 |
| SLES 12 SP5 | perl-DBI | 1.628-5.29.1 | SUSE-SU-2026:4442-1 |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP5 | perl-DBI | 1.642-150200.3.26.1 | SUSE-SU-2026:4612-1 |
| SLES for SAP 15 SP4 | perl-DBI | 1.642-150200.3.26.1 | SUSE-SU-2026:4612-1 |
| SLE HPC 15 SP5 | perl-DBI | 1.642-150200.3.26.1 | SUSE-SU-2026:4612-1 |
| SLE HPC 15 SP4 | perl-DBI | 1.642-150200.3.26.1 | SUSE-SU-2026:4612-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | perl-DBI | 1.655.0-1.1 | openSUSE-SU-2026:11966-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | perl-DBI +1 | 1.656-1.amzn2023.0.1 | ALAS2023-2026-3414 |
| Amazon Linux 2 | perl-DBI | 1.627-4.amzn2.0.9 | ALAS2-2026-4077 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | perl-DBI | 1.655-1 | — |
Advisories 7
- ALAS2023-2026-3414 Moderate: perl-DBI security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Nov 9, 2026
- ALAS2-2026-4077 Moderate: perl-DBI security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Nov 9, 2026
- SUSE-SU-2026:4805-1 Security update for perl-DBI SUSE / openSUSE Security Updates · Oct 21, 2026
- USN-8912-1 libdbi-perl vulnerabilities Ubuntu Security Notices (USN) · Oct 12, 2026
- SUSE-SU-2026:4612-1 Security update for perl-DBI SUSE / openSUSE Security Updates · Oct 10, 2026
- SUSE-SU-2026:4442-1 Security update for perl-DBI SUSE / openSUSE Security Updates · Oct 5, 2026
- openSUSE-SU-2026:11966-1 perl-DBI-1.655.0-1.1 on GA media SUSE / openSUSE Security Updates · Oct 3, 2026