rpm package
almalinux/perl-DBI
pkg:rpm/almalinux/perl-DBI
Vulnerabilities (4)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-14739 | Cri | 9.8 | < 1.643-26.el10_2.3 | 1.643-26.el10_2.3 | Jul 7, 2026 | DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders. The fix for CVE-2026-10879 did not allocate enough memory to handle approximately 1.2-million placeholders. DBI version 1.650 sets a hard limit of 99,9 | |
| CVE-2026-14380 | Hig | 8.8 | < 1.643-26.el10_2.3 | 1.643-26.el10_2.3 | Jul 7, 2026 | DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile. When a string is assigned to a DBI handle's Profile attribute, DBI splits it into path, package and arguments, and interpolates the package part in a string eval with no validation | |
| CVE-2026-9698 | Cri | 9.8 | < 1.643-9.el9_8.1 | 1.643-9.el9_8.1 | Jun 9, 2026 | DBI versions before 1.648 for Perl saved errors in a limited-sized buffer. Error messages that were returned when RaiseError, PrintError or HandleError were set were written to a 200-byte buffer without a length limit. Attackers that can influence the error text in an applicati | |
| CVE-2026-10879 | Cri | 9.8 | < 1.641-2.el8_10 | 1.641-2.el8_10 | Jun 5, 2026 | DBI versions before 1.648 for Perl have a heap overflow when preparsing SQL statements with more than 9 binders. The preparse method expands SQL placeholder characters to numbered binders of the form :pN, but only allocates three characters per binder in the buffer. Placeholder |
- affected < 1.643-26.el10_2.3fixed 1.643-26.el10_2.3
DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders. The fix for CVE-2026-10879 did not allocate enough memory to handle approximately 1.2-million placeholders. DBI version 1.650 sets a hard limit of 99,9
- affected < 1.643-26.el10_2.3fixed 1.643-26.el10_2.3
DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile. When a string is assigned to a DBI handle's Profile attribute, DBI splits it into path, package and arguments, and interpolates the package part in a string eval with no validation
- affected < 1.643-9.el9_8.1fixed 1.643-9.el9_8.1
DBI versions before 1.648 for Perl saved errors in a limited-sized buffer. Error messages that were returned when RaiseError, PrintError or HandleError were set were written to a 200-byte buffer without a length limit. Attackers that can influence the error text in an applicati
- affected < 1.641-2.el8_10fixed 1.641-2.el8_10
DBI versions before 1.648 for Perl have a heap overflow when preparsing SQL statements with more than 9 binders. The preparse method expands SQL placeholder characters to numbered binders of the form :pN, but only allocates three characters per binder in the buffer. Placeholder