CVE-2026-10879

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-10879
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-10879.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-10879
Downstream
ALPINE (1)
ALSA (4)
AZL (1)
BELL (1)
DEBIAN (1)
ECHO (1)
MGASA (1)
OESA (1)
openSUSE (2)
RHSA (4)
RLSA (1)
SUSE (3)
UBUNTU (1)
Related
ALSA (4)
openSUSE (2)
SUSE (3)
Published
2026-06-05T14:30:58Z
Modified
2026-10-29T11:42:21Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
DBI versions before 1.648 for Perl have a heap overflow when preparsing SQL statements with more than 9 binders
Details

DBI versions before 1.648 for Perl have a heap overflow when preparsing SQL statements with more than 9 binders.

The preparse method expands SQL placeholder characters to numbered binders of the form :pN, but only allocates three characters per binder in the buffer. Placeholders 10-99 require four characters, 100-999 require five characters, et cetera.

Database specific 
{
    "cna_assigner": "CPANSec",
    "cwe_ids": [
        "CWE-787"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10879.json"
}
References

Affected packages

Git / github.com/perl5-dbi/dbi

Affected ranges

Type
GIT
Repo
https://github.com/perl5-dbi/dbi
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
77c5de11da879ec6a869c4c89bc0ff8bf6e2921f
Fixed
af79036c07aa9a457971c0f4136e37c85dc20978
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:perl:dbi:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "1.648"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "range": [
                {
                    "fixed": "af79036c07aa9a457971c0f4136e37c85dc20978"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

1.*
1.602
1.607
1.611_90
1.611_91
1.611_92
1.611_93
1.611_94
1.613_70
1.613_71
1.613_90
1.613_91
1.613_92
1.613_93
1.614_90
1.615
1.618
1.619
1.622
1.624
1.625
1.626
1.627
1.628
1.630
1.631
1.632
1.632_90
1.633
1.633_90
1.633_91
1.633_92
1.634
1.635
1.636
1.637
1.638
1.639
1.640
1.641
1.642
1.643
1.643_01
1.643_02
1.644
1.645
1.646
1.647
DBI-1.*
DBI-1.47
DBI-1.51
DBI-1.57
DBI-1.58

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-10879.json"