CVE-2026-10879
published 2026-06-05CVE-2026-10879: DBI versions before 1.648 for Perl have a heap overflow when preparsing SQL statements with more than 9 binders. The preparse method expands SQL placeholder…
PriorityP358critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.48%
39.0th percentile
DBI versions before 1.648 for Perl have a heap overflow when preparsing SQL statements with more than 9 binders.
The preparse method expands SQL placeholder characters to numbered binders of the form :pN, but only allocates three characters per binder in the buffer. Placeholders 10-99 require four characters, 100-999 require five characters, et cetera.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| hmbrand | dbi | < 1.650 | 1.650 |
| perl-dbi_1.641 | perl-dbi | — | — |
| perl | dbi | < 1.648 | 1.648 |
| perl | dbi | < 1.650 | 1.650 |
| ubuntu | libdbi-perl | — | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vendor_redhat9.8CRITICAL
vendor_ubuntu9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders.
ghsa_unreviewed·2026-07-08·CVSS 9.8
CVE-2026-14739 [CRITICAL] CWE-787 DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders.
DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders.
The fix for CVE-2026-10879 did not allocate enough memory to handle approximately 1.2-million placeholders.
DBI version 1.650 sets a hard limit of 99,999 placeholders.
VulDB
HMBRAND DBI up to 1.647 on Perl Placeholder preparse out-of-bounds write (EUVD-2026-34843)
vuldb·2026-06-05
CVE-2026-10879 [CRITICAL] HMBRAND DBI up to 1.647 on Perl Placeholder preparse out-of-bounds write (EUVD-2026-34843)
A vulnerability classified as critical has been found in HMBRAND DBI up to 1.647 on Perl. This impacts the function preparse of the component Placeholder Handler. The manipulation leads to out-of-bounds write.
This vulnerability is uniquely identified as CVE-2026-10879. The attack is possible to be carried out remotely. No exploit exists.
It is recommended to upgrade the affected component.
GHSA
DBI versions before 1.648 for Perl have a heap overflow when preparsing SQL statements with more than 9 binders.
ghsa_unreviewed·2026-06-05
CVE-2026-10879 CWE-787 DBI versions before 1.648 for Perl have a heap overflow when preparsing SQL statements with more than 9 binders.
DBI versions before 1.648 for Perl have a heap overflow when preparsing SQL statements with more than 9 binders.
The preparse method expands SQL placeholder characters to numbered binders of the form :pN, but only allocates three characters per binder in the buffer. Placeholders 10-99 require four characters, 100-999 require five characters, et cetera.
Red Hat
DBI: DBI: Heap overflow when preparsing SQL statements with excessive placeholders
vendor_redhat·2026-07-07·CVSS 9.8
CVE-2026-14739 [CRITICAL] CWE-131 DBI: DBI: Heap overflow when preparsing SQL statements with excessive placeholders
DBI: DBI: Heap overflow when preparsing SQL statements with excessive placeholders
DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders.
The fix for CVE-2026-10879 did not allocate enough memory to handle approximately 1.2-million placeholders.
DBI version 1.650 sets a hard limit of 99,999 placeholders.
A flaw was found in DBI for Perl. This vulnerability, a heap overflow, occurs when the software attempts to preparse SQL statements containing an extremely large number of placeholders. This could allow a remote attacker to cause a denial of service or potentially execute arbitrary code.
Statement: This vulnerability in DBI for Perl is rated as Important. A heap overflow can occur when processing SQL statements with
Ubuntu
Perl DBI module vulnerabilities
vendor_ubuntu·2026-06-24·CVSS 9.8
CVE-2026-10879 [CRITICAL] Perl DBI module vulnerabilities
Title: Perl DBI module vulnerabilities
Summary: Several security issues were fixed in Perl DBI module.
It was discovered that the Perl DBI module incorrectly handled certain
error messages. An attacker could use this issue to cause applications
using the Perl DBI module to crash, resulting in a denial of service, or
possibly execute arbitrary code. (CVE-2026-9698)
It was discovered that the Perl DBI module incorrectly handled memory when
preparsing SQL statements that included more than nine binders. An attacker
could use this issue to cause applications using the Perl DBI module to
crash, resulting in a denial of service, or possibly execute arbitrary
code. (CVE-2026-10879)
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
perl-DBI: perl-DBI: Heap overflow in SQL preparsing can lead to denial of service or arbitrary code execution.
vendor_redhat·2026-06-05·CVSS 9.8
CVE-2026-10879 [CRITICAL] CWE-131 perl-DBI: perl-DBI: Heap overflow in SQL preparsing can lead to denial of service or arbitrary code execution.
perl-DBI: perl-DBI: Heap overflow in SQL preparsing can lead to denial of service or arbitrary code execution.
DBI versions before 1.648 for Perl have a heap overflow when preparsing SQL statements with more than 9 binders.
The preparse method expands SQL placeholder characters to numbered binders of the form :pN, but only allocates three characters per binder in the buffer. Placeholders 10-99 require four characters, 100-999 require five characters, et cetera.
A flaw was found in perl-DBI. A heap overflow vulnerability exists when preparsing SQL statements with more than 9 binders. The `preparse` method incorrectly allocates buffer space for SQL placeholder characters, leading to an overflow when processing binders with two or more digits. This can result in a denial of service or poten
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-14739 perl-DBI: DBI: Heap overflow when preparsing SQL statements with excessive placeholders [fedora-all]
bugzilla·2026-07-08·CVSS 9.8
CVE-2026-14739 [CRITICAL] CVE-2026-14739 perl-DBI: DBI: Heap overflow when preparsing SQL statements with excessive placeholders [fedora-all]
CVE-2026-14739 perl-DBI: DBI: Heap overflow when preparsing SQL statements with excessive placeholders [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders.
The fix for CVE-2026-10879 did not allocate enough memory to handle approximately 1.2-million placeholders.
DBI version 1.650 sets a hard limit of 99,999 placeholders.
Bugzilla
CVE-2026-14739 DBI: DBI: Heap overflow when preparsing SQL statements with excessive placeholders
bugzilla·2026-07-07·CVSS 9.8
CVE-2026-14739 [CRITICAL] CVE-2026-14739 DBI: DBI: Heap overflow when preparsing SQL statements with excessive placeholders
CVE-2026-14739 DBI: DBI: Heap overflow when preparsing SQL statements with excessive placeholders
DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders.
The fix for CVE-2026-10879 did not allocate enough memory to handle approximately 1.2-million placeholders.
DBI version 1.650 sets a hard limit of 99,999 placeholders.
Bugzilla
CVE-2026-10879 perl-DBI: perl-DBI: Heap overflow in SQL preparsing can lead to denial of service or arbitrary code execution.
bugzilla·2026-06-05·CVSS 9.8
CVE-2026-10879 [CRITICAL] CVE-2026-10879 perl-DBI: perl-DBI: Heap overflow in SQL preparsing can lead to denial of service or arbitrary code execution.
CVE-2026-10879 perl-DBI: perl-DBI: Heap overflow in SQL preparsing can lead to denial of service or arbitrary code execution.
DBI versions before 1.648 for Perl have a heap overflow when preparsing SQL statements with more than 9 binders.
The preparse method expands SQL placeholder characters to numbered binders of the form :pN, but only allocates three characters per binder in the buffer. Placeholders 10-99 require four characters, 100-999 require five characters, et cetera.
Rapid7
Patch Tuesday - June 2026
blogs_rapid7·2026-06-09·CVSS 7.8
CVE-2026-33825 [HIGH] Patch Tuesday - June 2026
Microsoft is publishing 200 vulnerabilities on June 2026 Patch Tuesday . Microsoft is not aware of exploitation in the wild for any of these vulnerabilities, and is aware of public disclosure for three. This is similar to last month’s Patch Tuesday, however several of last month’s vulnerabilities ended up on CISA KEV in the days following their publication. So far this month, Microsoft has provided patches to address 360 browser vulnerabilities, which is an order of magnitude more than has been typical in any given month over the past few years. As usual, browser vulns are not included in the Patch Tuesday count above. Indeed, the vast, and presumably sustained, uptick in the number of browser vulnerabilities has led to Microsoft no longer enumerating Chromium CVEs in the Security Update G
2026-06-05
Published