CVE-2026-14739
Fixed in a distro release EPSS <1%CVSS 9.8
DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders. The fix for CVE-2026-10879 did not allocate enough memory to handle approximately 1.2-million placeholders. DBI version 1.650 sets a hard limit of 99,999 placeholders.
Products: HMBRAND DBI
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 10 | perl-DBI | 1.643-26.el10_2.3 |
| AlmaLinux 8 | perl-DBI | 1.641-8.module_el8.10.0+4245+6005333d |
| AlmaLinux 8 | perl-DBI | 1.641-2.el8_10 |
| AlmaLinux 9 | perl-DBI | 1.643-9.el9_8.3 |
| Alpine 3.24 | perl-dbi | 1.651-r0 |
| Amazon Linux 2 | perl-DBI | 1.627-4.amzn2.0.4 |
| Amazon Linux 2023 | perl-DBI | 1.650-1.amzn2023.0.1 |
| Amazon Linux 2023 | perl-DBI-tests | 1.650-1.amzn2023.0.1 |
| Debian 12 | libdbi-perl | 1.643-4+deb12u2 |
| Debian 13 | libdbi-perl | 1.652-2~deb13u1 |
| Debian 14 | libdbi-perl | 1.650-1 |
| Red Hat Enterprise Linux 10.2 | perl-DBI | 0:1.643-26.el10_2.3 |
| Red Hat Enterprise Linux 10.2 | perl-DBI-debuginfo | 0:1.643-26.el10_2.3 |
| Red Hat Enterprise Linux 10.2 | perl-DBI-debugsource | 0:1.643-26.el10_2.3 |
| Red Hat Enterprise Linux 8 | perl-DBI | 0:1.641-2.el8_10 |
| Red Hat Enterprise Linux 8 | perl-DBI | 0:1.641-8.module+el8.10.0+24620+ff0e05e9 |
| Red Hat Enterprise Linux 8 | perl-DBI-debuginfo | 0:1.641-2.el8_10 |
| Red Hat Enterprise Linux 8 | perl-DBI-debuginfo | 0:1.641-8.module+el8.10.0+24620+ff0e05e9 |
| Red Hat Enterprise Linux 8 | perl-DBI-debugsource | 0:1.641-8.module+el8.10.0+24620+ff0e05e9 |
| Red Hat Enterprise Linux 8 | perl-DBI-debugsource | 0:1.641-2.el8_10 |
| Red Hat Enterprise Linux 9 | perl-DBI | 0:1.643-9.el9_8.3 |
| Red Hat Enterprise Linux 9 | perl-DBI-debuginfo | 0:1.643-9.el9_8.3 |
| Red Hat Enterprise Linux 9 | perl-DBI-debugsource | 0:1.643-9.el9_8.3 |
| Rocky Linux 10 | perl-DBI | 0:1.643-26.el10_2.3 |
| Rocky Linux 8 | perl-DBI | 0:1.641-8.module+el8.10.0+40273+0bbde87c |
| Rocky Linux 8 | perl-DBI | 0:1.641-8.module+el8.10.0+40273+66ce089d |
| Rocky Linux 8 | perl-DBI | 0:1.641-8.module+el8.10.0+40273+4d327a6c |
| Rocky Linux 8 | perl-DBI | 0:1.641-8.module+el8.10.0+40273+d479100a |
| Rocky Linux 8 | perl-DBI | 0:1.641-2.el8_10 |
| Rocky Linux 9 | perl-DBI | 0:1.643-9.el9_8.3 |
| Ubuntu 22.04 LTS | libdbi-perl | no fix |
| Ubuntu 24.04 LTS | libdbi-perl | no fix |
| Ubuntu 25.10 | libdbi-perl | no fix |
| Ubuntu 26.04 LTS | libdbi-perl | no fix |
| Ubuntu 26.10 | libdbi-perl | no fix |
| Ubuntu Pro 14.04 LTS | libdbi-perl | no fix |
| Ubuntu Pro 16.04 LTS | libdbi-perl | no fix |
| Ubuntu Pro 18.04 LTS | libdbi-perl | no fix |
| Ubuntu Pro 20.04 LTS | libdbi-perl | no fix |
| openSUSE Tumbleweed | perl-DBI | 1.650.0-1.1 |