CVE-2026-14739

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-14739
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-14739.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-14739
Downstream
ALPINE (1)
ALSA (4)
AZL (1)
BELL (1)
CLSA (2)
DEBIAN (1)
ECHO (1)
MGASA (1)
OESA (1)
openSUSE (1)
RHSA (4)
RLSA (4)
ROOT (1)
UBUNTU (1)
Related
ALSA (4)
openSUSE (1)
Published
2026-07-07T22:05:18Z
Modified
2026-10-28T02:30:28Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders
Details

DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders.

The fix for CVE-2026-10879 did not allocate enough memory to handle approximately 1.2-million placeholders.

DBI version 1.650 sets a hard limit of 99,999 placeholders.

Database specific 
{
    "cna_assigner": "CPANSec",
    "cwe_ids": [
        "CWE-787"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/14xxx/CVE-2026-14739.json"
}
References

Affected packages

Git / github.com/perl5-dbi/dbi

Affected ranges

Type
GIT
Repo
https://github.com/perl5-dbi/dbi
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
e471b1e8667b8b1de404db07e0c9331df06eb621
Fixed
2b77c88b655e9539a592c71a61fb965fc0075395
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:perl:dbi:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "1.650"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "range": [
                {
                    "fixed": "2b77c88b655e9539a592c71a61fb965fc0075395"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

1.*
1.602
1.607
1.611_90
1.611_91
1.611_92
1.611_93
1.611_94
1.613_70
1.613_71
1.613_90
1.613_91
1.613_92
1.613_93
1.614_90
1.615
1.618
1.619
1.622
1.624
1.625
1.626
1.627
1.628
1.630
1.631
1.632
1.632_90
1.633
1.633_90
1.633_91
1.633_92
1.634
1.635
1.636
1.637
1.638
1.639
1.640
1.641
1.642
1.643
1.643_01
1.643_02
1.644
1.645
1.646
1.647
1.648
1.649
DBI-1.*
DBI-1.47
DBI-1.51
DBI-1.57
DBI-1.58

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-14739.json"