CVE-2026-10879
Critical · 9.8CVSS
9.8
EPSS
0.5%
Published
Jun 5, 2026
CISA due date
—
The record
DBI versions before 1.648 for Perl have a heap overflow when preparsing SQL statements with more than 9 binders. The preparse method expands SQL placeholder characters to numbered binders of the form :pN, but only allocates three characters per binder in the buffer. Placeholders 10-99 require four characters, 100-999 require five characters, et cetera.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 16.0 | perl-DBI | 0 | 1.647.0-160000.3.1 |
| openSUSE:Tumbleweed | perl-DBI | 0 | 1.648.0-1.1 |
Related vulnerabilities
- CVE-2026-9698 DBI versions before 1.648 for Perl saved errors in a limited-sized buffer. Also affects perl-DBI
- CVE-2026-111497 A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli… CWE-787
- CVE-2026-112397 Pillow is a Python imaging library. CWE-787
- CVE-2026-112059 libLAS through 1.8.1 contains a heap out-of-bounds write vulnerability in the point… CWE-787
- CVE-2026-89088 A flaw was found in parted. CWE-787
- CVE-2026-89085 A flaw was found in parted. CWE-787
- CVE-2026-85746 MariaDB server is a community developed fork of MySQL server. CWE-787
- CVE-2026-107815 MariaDB server is a community developed fork of MySQL server. CWE-787