CVE-2026-14740
published 2026-07-07CVE-2026-14740: DBI versions before 1.650 for Perl read one byte out-of-bounds in preparse when deleting an initial SQL comment. The preparse method normalises SQL and removes…
PriorityP352critical9.1CVSS 3.1
AVNACLPRNUINSUCHINAH
EPSS
0.41%
33.0th percentile
DBI versions before 1.650 for Perl read one byte out-of-bounds in preparse when deleting an initial SQL comment.
The preparse method normalises SQL and removes comments. When the SQL starts with a comment line, the deletion of that line during normalisation led to an out-of-bounds read by one byte. The result is a fault on memory-hardened builds and nondeterministic newline retention on normal builds.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| hmbrand | dbi | < 1.650 | 1.650 |
| perl | dbi | < 1.650 | 1.650 |
CVSS provenance
nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
vendor_redhat9.1CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
DBI: DBI for Perl: Out-of-bounds read in SQL comment processing
vendor_redhat·2026-07-07·CVSS 9.1
CVE-2026-14740 [CRITICAL] CWE-125 DBI: DBI for Perl: Out-of-bounds read in SQL comment processing
DBI: DBI for Perl: Out-of-bounds read in SQL comment processing
DBI versions before 1.650 for Perl read one byte out-of-bounds in preparse when deleting an initial SQL comment.
The preparse method normalises SQL and removes comments. When the SQL starts with a comment line, the deletion of that line during normalisation led to an out-of-bounds read by one byte. The result is a fault on memory-hardened builds and nondeterministic newline retention on normal builds.
A flaw was found in DBI for Perl. When processing SQL queries, the `preparse` method, which normalizes SQL and removes comments, can read one byte beyond its intended memory boundary. This occurs specifically when an SQL query begins with a comment line, leading to an out-of-bounds read during the comment deletion process. This
VulDB
DBI up to 1.649 SQL Comment preparse out-of-bounds (EUVD-2026-42125)
vuldb·2026-07-08
CVE-2026-14740 [CRITICAL] DBI up to 1.649 SQL Comment preparse out-of-bounds (EUVD-2026-42125)
A vulnerability described as critical has been identified in DBI up to 1.649. The impacted element is the function preparse of the component SQL Comment Handler. Such manipulation leads to out-of-bounds read.
This vulnerability is traded as CVE-2026-14740. The attack may be launched remotely. There is no exploit available.
No detection rules found.
No public exploits indexed.
2026-07-07
Published