CVE-2026-10879
Fixed in a distro release EPSS <1%CVSS 9.8
DBI versions before 1.648 for Perl have a heap overflow when preparsing SQL statements with more than 9 binders. The preparse method expands SQL placeholder characters to numbered binders of the form :pN, but only allocates three characters per binder in the buffer. Placeholders 10-99 require four characters, 100-999 require five characters, et cetera.
Products: HMBRAND DBI
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 8 | perl-DBI | 1.641-2.el8_10 |
| Alpine 3.24 | perl-dbi | 1.648-r0 |
| Amazon Linux 2 | perl-DBI | 1.627-4.amzn2.0.3 |
| Amazon Linux 2023 | perl-DBI | 1.648-1.amzn2023.0.1 |
| Amazon Linux 2023 | perl-DBI-tests | 1.648-1.amzn2023.0.1 |
| Debian 12 | libdbi-perl | 1.643-4+deb12u1 |
| Debian 13 | libdbi-perl | 1.647-1+deb13u1 |
| Debian 14 | libdbi-perl | 1.648-1 |
| Red Hat Enterprise Linux 10.2 | perl-DBI | 0:1.643-26.el10_2.1 |
| Red Hat Enterprise Linux 10.2 | perl-DBI-debuginfo | 0:1.643-26.el10_2.1 |
| Red Hat Enterprise Linux 10.2 | perl-DBI-debugsource | 0:1.643-26.el10_2.1 |
| Red Hat Enterprise Linux 8 | perl-DBI | 0:1.641-5.module+el8.10.0+24438+dc2220dd |
| Red Hat Enterprise Linux 8 | perl-DBI | 0:1.641-2.el8_10 |
| Red Hat Enterprise Linux 8 | perl-DBI-debuginfo | 0:1.641-5.module+el8.10.0+24438+dc2220dd |
| Red Hat Enterprise Linux 8 | perl-DBI-debuginfo | 0:1.641-2.el8_10 |
| Red Hat Enterprise Linux 8 | perl-DBI-debugsource | 0:1.641-5.module+el8.10.0+24438+dc2220dd |
| Red Hat Enterprise Linux 8 | perl-DBI-debugsource | 0:1.641-2.el8_10 |
| Red Hat Enterprise Linux 9 | perl-DBI | 0:1.643-9.el9_8.1 |
| Red Hat Enterprise Linux 9 | perl-DBI-debuginfo | 0:1.643-9.el9_8.1 |
| Red Hat Enterprise Linux 9 | perl-DBI-debugsource | 0:1.643-9.el9_8.1 |
| Rocky Linux 8 | perl-DBI | 0:1.641-2.el8_10 |
| SUSE Linux Enterprise Module for Basesystem 15 SP7 | perl-DBI | 1.647.0-150600.12.11.1 |
| SUSE Linux Enterprise Server 15 SP6-LTSS | perl-DBI | 1.647.0-150600.12.11.1 |
| SUSE Linux Enterprise Server 16.0 | perl-DBI | 1.647.0-160000.3.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | perl-DBI | 1.647.0-150600.12.11.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | perl-DBI | 1.647.0-160000.3.1 |
| SUSE Linux Micro 6.2 | perl-DBI | 1.647.0-160000.3.1 |
| Ubuntu 22.04 LTS | libdbi-perl | 1.643-3ubuntu0.1 |
| Ubuntu 24.04 LTS | libdbi-perl | 1.643-4ubuntu0.1 |
| Ubuntu 25.10 | libdbi-perl | 1.647-1ubuntu0.25.10.1 |
| Ubuntu 26.04 LTS | libdbi-perl | 1.647-1ubuntu0.26.04.1 |
| Ubuntu Pro 14.04 LTS | libdbi-perl | 1.630-1ubuntu0.1~esm6 |
| Ubuntu Pro 16.04 LTS | libdbi-perl | 1.634-1ubuntu0.2+esm2 |
| Ubuntu Pro 18.04 LTS | libdbi-perl | 1.640-1ubuntu0.3+esm1 |
| Ubuntu Pro 20.04 LTS | libdbi-perl | 1.643-1ubuntu0.1+esm1 |
| openSUSE Leap 16.0 | perl-DBI | 1.647.0-160000.3.1 |
| openSUSE Tumbleweed | perl-DBI | 1.648.0-1.1 |