CVE-2026-14740
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
A vulnerability in the DBI library for Perl before version 1.650 causes an out-of-bounds read by one byte during processing of an initial SQL comment in the preparse method. The issue occurs when deleting a comment at the beginning of an SQL query.
Risk Assessment
An attacker could exploit this vulnerability to cause a critical fault on memory-hardened systems or unpredictable application behavior, potentially leading to service disruption or data leakage.
Recommendation
Immediately update the DBI library to version 1.650 or later. If an update is not possible, avoid processing SQL queries that start with comments.
Original NVD description (English source)
DBI versions before 1.650 for Perl read one byte out-of-bounds in preparse when deleting an initial SQL comment. The preparse method normalises SQL and removes comments. When the SQL starts with a comment line, the deletion of that line during normalisation led to an out-of-bounds read by one byte. The result is a fault on memory-hardened builds and nondeterministic newline retention on normal builds.