CVE-2026-9698
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
DBI for Perl before version 1.648 saves error messages in a limited-size buffer (200 bytes) without length control. Attackers who can influence error text may cause a buffer overflow.
Risk Assessment
Buffer overflow can lead to application crashes or potential code execution, threatening system stability.
Recommendation
Update DBI to version 1.648 or later. Restrict the ability of attackers to influence error message content.
Original NVD description (English source)
DBI versions before 1.648 for Perl saved errors in a limited-sized buffer. Error messages that were returned when RaiseError, PrintError or HandleError were set were written to a 200-byte buffer without a length limit. Attackers that can influence the error text in an application can trigger a buffer overflow.