CVE-2026-14740
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
A vulnerability in the DBI library for Perl before version 1.650 causes an out-of-bounds read by one byte during processing of an initial SQL comment in the preparse method. The issue occurs when deleting a comment at the beginning of an SQL query.
Risk Assessment
An attacker could exploit this vulnerability to cause a critical fault on memory-hardened systems or unpredictable application behavior, potentially leading to service disruption or data leakage.
Recommendation
Immediately update the DBI library to version 1.650 or later. If an update is not possible, avoid processing SQL queries that start with comments.
Other vulnerabilities in DBI
See all- CVE-2026-73194Critical
In DBI for Perl before version 1.652, a heap out-of-bounds write occurs via an unvalidated numeric placeholder that sets the binder counter in preparse. A crafted statement can cause a write beyond the allocated buffer.
- CVE-2026-73193Critical
In DBI for Perl before version 1.652, a heap out-of-bounds write occurs on 32-bit Perl due to integer wraparound in the output buffer size computed by preparse. A very long statement can cause a write beyond the allocated buffer.
- CVE-2026-60082Critical
A vulnerability in the DBI library for Perl before version 1.651 does not enforce statement handle consistency with the row. When the statement handle had no fields but the source row was non-empty, the internal row-buffer helper would read from a negative array index.
- CVE-2026-14739Critical
A heap overflow vulnerability in DBI versions before 1.650 for Perl occurs when preparsing SQL statements with an extreme number of placeholders. The fix for CVE-2026-10879 did not allocate enough memory to handle approximately 1.2 million placeholders. Version 1.650 sets a hard limit of 99,999 placeholders.
- CVE-2026-9698Critical
DBI for Perl before version 1.648 saves error messages in a limited-size buffer (200 bytes) without length control. Attackers who can influence error text may cause a buffer overflow.
- CVE-2026-19546High
A flaw was found in DBI, which is a fix for a partial fix for CVE-2026-14380 for RHEL 9.8.z and 10.2.z. Detailed information is available in the original description on the Red Hat website.
- CVE-2026-14380High
Vulnerability in DBI for Perl before version 1.650 allows code injection via the Profile attribute, which is interpolated in eval without validation. An attacker can control Profile through the DBI_PROFILE environment variable, direct assignment, or DSN clause, leading to arbitrary Perl code execution.
Original NVD description (English source)
DBI versions before 1.650 for Perl read one byte out-of-bounds in preparse when deleting an initial SQL comment. The preparse method normalises SQL and removes comments. When the SQL starts with a comment line, the deletion of that line during normalisation led to an out-of-bounds read by one byte. The result is a fault on memory-hardened builds and nondeterministic newline retention on normal builds.