CVE-2026-60082
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
A vulnerability in the DBI library for Perl before version 1.651 does not enforce statement handle consistency with the row. When the statement handle had no fields but the source row was non-empty, the internal row-buffer helper would read from a negative array index.
Risk Assessment
An attacker can supply inconsistent metadata and rows to the prepare method, leading to an out-of-bounds memory read. This could result in disclosure of sensitive data or application crash.
Recommendation
Update the DBI library to version 1.651 or later. If an update is not possible, avoid using the prepare method with inconsistent data.
Original NVD description (English source)
DBI versions before 1.651 for Perl do not enforce statement handle consistency with the row. When the statement handle had no fields but the source row was non-empty, the internal row-buffer helper would read from a negative array index. This could be triggered by a caller supplying inconsistent metadata and rows to the prepare method.