CVE-2026-14739
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
A heap overflow vulnerability in DBI versions before 1.650 for Perl occurs when preparsing SQL statements with an extreme number of placeholders. The fix for CVE-2026-10879 did not allocate enough memory to handle approximately 1.2 million placeholders. Version 1.650 sets a hard limit of 99,999 placeholders.
Risk Assessment
An attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service, potentially compromising the confidentiality, integrity, or availability of the system.
Recommendation
Immediately upgrade DBI to version 1.650 or later, which introduces a placeholder limit and prevents heap overflow.
Original NVD description (English source)
DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders. The fix for CVE-2026-10879 did not allocate enough memory to handle approximately 1.2-million placeholders. DBI version 1.650 sets a hard limit of 99,999 placeholders.