Vulnerability · Published Jun 5, 2026 · Assigned by CPANSec
CVE-2026-10879DBI versions before 1.648 for Perl have a heap overflow when preparsing SQL statements with more than 9 binders
Critical 9.8
In plain English
A critical-severity out-of-bounds write in DBI from HMBRAND. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
DBI versions before 1.648 for Perl have a heap overflow when preparsing SQL statements with more than 9 binders. The preparse method expands SQL placeholder characters to numbered binders of the form :pN, but only allocates three characters per binder in the buffer. Placeholders 10-99 require four characters, 100-999 require five characters, et cetera.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | perl-DBI | 1.643-26.el10_2.1 | ALSA-2026:38513 |
| AlmaLinux:8 | perl-DBI | 1.641-5.module_el8.10.0+4219+13f48a6e | ALSA-2026:38901 |
| AlmaLinux:8 | perl-DBI | 1.641-5.module_el8.10.0+4220+8669cc49 | ALSA-2026:38901 |
| AlmaLinux:8 | perl-DBI | 1.641-5.module_el8.10.0+4218+c616d9bd | ALSA-2026:38901 |
| AlmaLinux:8 | perl-DBI | 1.641-2.el8_10 | ALSA-2026:62667 |
| AlmaLinux:9 | perl-DBI | 1.643-9.el9_8.1 | ALSA-2026:38512 |
| Alpine:v3.24 | perl-dbi | 1.648-r0 | ALPINE-CVE-2026-10879 |
| Debian:12 | libdbi-perl | 1.643-4+deb12u1 | DEBIAN-CVE-2026-10879 |
| Debian:13 | libdbi-perl | 1.647-1+deb13u1 | DEBIAN-CVE-2026-10879 |
| Debian:14 | libdbi-perl | 1.648-1 | DEBIAN-CVE-2026-10879 |
| Rocky Linux:8 | perl-DBI | 0:1.641-2.el8_10 | RLSA-2026:62667 |
| Ubuntu:22.04:LTS | libdbi-perl | 1.643-3ubuntu0.1 | UBUNTU-CVE-2026-10879 |
| Ubuntu:24.04:LTS | libdbi-perl | 1.643-4ubuntu0.1 | UBUNTU-CVE-2026-10879 |
| Ubuntu:25.10 | libdbi-perl | 1.647-1ubuntu0.25.10.1 | UBUNTU-CVE-2026-10879 |
| Ubuntu:26.04:LTS | libdbi-perl | 1.647-1ubuntu0.26.04.1 | UBUNTU-CVE-2026-10879 |
Affected products (as reported)
Weakness: CWE-787 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H