CVE-2026-88815

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-88815
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-88815.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-88815
Aliases
  • GHSA-c8vq-w3wr-6979
Downstream
ALSA (4)
AZL (1)
BELL (1)
CLSA (2)
DEBIAN (1)
ECHO (1)
MGASA (1)
MINI (1)
OESA (4)
openSUSE (1)
RHSA (3)
RLSA (4)
SUSE (3)
UBUNTU (1)
Related
ALSA (4)
openSUSE (1)
SUSE (3)
Published
2026-09-28T16:04:22Z
Modified
2026-10-28T02:30:21Z
Severity
  • 6.2 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in sql_type_cast_svpv
Details

DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in sql_type_cast_svpv.

When casting to SQL_NUMERIC, sql_type_cast_svpv passes the string pointer and length of the SV to grok_number without stringifying it first. An integer (IV) or floating-point (NV) value has no valid string pointer, so grok_number reads from an invalid address, triggering a segmentation fault.

This is reachable in Perl using the sql_type_cast function:

my $num = 42; DBI::sql_type_cast( $num, DBI::SQL_NUMERIC, 0 );

Database specific 
{
    "cna_assigner": "CPANSec",
    "cwe_ids": [
        "CWE-843"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/88xxx/CVE-2026-88815.json"
}
References

Affected packages

Git / github.com/perl5-dbi/dbi

Affected ranges

Type
GIT
Repo
https://github.com/perl5-dbi/dbi
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
4e9aa3345770a3afd3cd37b305f15c97e3cd70bc
Fixed
e5ad87e5602da995d28b4d65df222368b58d6702
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "1.654"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "fixed": "e5ad87e5602da995d28b4d65df222368b58d6702"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

1.*
1.602
1.607
1.611_90
1.611_91
1.611_92
1.611_93
1.611_94
1.613_70
1.613_71
1.613_90
1.613_91
1.613_92
1.613_93
1.614_90
1.615
1.618
1.619
1.622
1.624
1.625
1.626
1.627
1.628
1.630
1.631
1.632
1.632_90
1.633
1.633_90
1.633_91
1.633_92
1.634
1.635
1.636
1.637
1.638
1.639
1.640
1.641
1.642
1.643
1.643_01
1.643_02
1.644
1.645
1.646
1.647
1.648
1.649
1.650
1.651
1.652
1.653
DBI-1.*
DBI-1.47
DBI-1.51
DBI-1.57
DBI-1.58

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-88815.json"