CVE-2026-15043
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
In DBI::SQL::Nano for Perl versions 1.42 through 1.651, the <= and >= SQL operators are inverted for text comparisons. The <= operator is incorrectly evaluated as 'greater than or equal', and >= as 'less than or equal', causing incorrect WHERE clause filtering.
Risk Assessment
The organization may face security policy or authorization violations when applications using DBI::SQL::Nano rely on WHERE clauses to filter file-backed data. Incorrect comparisons can return unauthorized rows, leading to data leakage or improper access.
Recommendation
Upgrade DBI::SQL::Nano to version 1.652 or later immediately. If an upgrade is not possible, temporarily install SQL::Statement to avoid using the vulnerable SQL::Nano engine.
Original NVD description (English source)
DBI::SQL::Nano versions from 1.42 before 1.651 for Perl have inverted <= and >= SQL operators on text. DBI::SQL::Nano, DBI's built-in mini-SQL engine, evaluated WHERE predicates incorrectly in some cases. In the non-numeric string branch of the is_matched method, <= was evaluated using Perl's ge operator, and >= was evaluated using Perl's le operator. SQL::Nano is the fallback query engine for DBI's file-backed drivers (DBD::File, DBD::DBM, CSV-style drivers) whenever SQL::Statement is not installed, and is forced whenever DBI_SQL_NANO=1. Queries over such tables use these predicates directly. The impact depends on the context. Where an application relies on a WHERE clause to filter file-backed data for policy or authorization, an inverted <=/>= comparison silently returns the wrong rows.