9.1
Critical
CVE-2026-60082 DBI versions before 1.651 for Perl do not enforce statement handle consistency with the row
Description
DBI versions before 1.651 for Perl do not enforce statement handle consistency with the row. When the statement handle had no fields but the source row was non-empty, the internal row-buffer helper would read from a negative array index. This could be triggered by a caller supplying inconsistent metadata and rows to the prepare method.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| DBI 1.651 | earliest → < 1.651 | 1.651 |
References
- github.com github.com
- metacpan.org metacpan.org
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of DBI
The 6 CVEs of DBI →
CVE-2026-14740
DBI versions before 1.650 for Perl read one byte out-of-bounds in preparse when deleting an initial SQL comment
9.1
Critical
CVE-2026-14739
DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of…
9.8
Critical
CVE-2026-14380
DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile
8.8
High
CVE-2026-9698
DBI versions before 1.648 for Perl saved errors in a limited-sized buffer
7.5
High