CVE-2026-88816

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-88816

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-88816.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-88816

Aliases

GHSA-f4qx-mr9m-q2hq

Downstream

Published

2026-09-28T16:04:40Z

Modified

2026-09-30T03:47:27Z

Summary

DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in FetchHashKeyName

Details

DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in FetchHashKeyName.

fetchrow_hashref uses the string pointer of the FetchHashKeyName attribute as the key name without stringifying it first. When FetchHashKeyName has been set to an integer (IV) or floating-point (NV) value, that pointer is invalid, so reading the key name triggers a segmentation fault.

This can be triggered with the following code:

my $dbh = DBI->connect( "dbi:ExampleP:", "", "", { RaiseError => 0, PrintError => 0 } ); $dbh->{FetchHashKeyName} = 42;

my $sth = $dbh->prepare("select mode, size, name from ."); $sth->execute; $sth->fetchrow_hashref;

Database specific

{
    "cna_assigner":  "CPANSec",
    "cwe_ids":  [
        "CWE-843"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/88xxx/CVE-2026-88816.json"
}

References

Affected packages

Git / github.com/perl5-dbi/dbi

Affected ranges

Type

GIT

Repo

https://github.com/perl5-dbi/dbi

Events

Introduced

Fixed

4e9aa3345770a3afd3cd37b305f15c97e3cd70bc

Fixed

70962570212dc60a5428098cf2a0462ad5945851

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "1.654"
        }
    ],
    "source":  [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

1.*

1.602

1.607

1.611_90

1.611_91

1.611_92

1.611_93

1.611_94

1.613_70

1.613_71

1.613_90

1.613_91

1.613_92

1.613_93

1.614_90

1.615

1.618

1.619

1.622

1.624

1.625

1.626

1.627

1.628

1.630

1.631

1.632

1.632_90

1.633

1.633_90

1.633_91

1.633_92

1.634

1.635

1.636

1.637

1.638

1.639

1.640

1.641

1.642

1.643

1.643_01

1.643_02

1.644

1.645

1.646

1.647

1.648

1.649

1.650

1.651

1.652

1.653

DBI-1.*

DBI-1.47

DBI-1.51

DBI-1.57

DBI-1.58

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-88816.json"