Vulnerability · Published Jul 7, 2026 · Assigned by CPANSec
CVE-2026-14739DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders
Critical 9.8
In plain English
A critical-severity out-of-bounds write in DBI from HMBRAND. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)0.4%top 64.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders. The fix for CVE-2026-10879 did not allocate enough memory to handle approximately 1.2-million placeholders. DBI version 1.650 sets a hard limit of 99,999 placeholders.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | perl-DBI | 1.643-26.el10_2.3 | ALSA-2026:49514 |
| AlmaLinux:8 | perl-DBI | 1.641-2.el8_10 | ALSA-2026:62667 |
| AlmaLinux:8 | perl-DBI | 1.641-8.module_el8.10.0+4245+6005333d | ALSA-2026:52772 |
| AlmaLinux:9 | perl-DBI | 1.643-9.el9_8.3 | ALSA-2026:49612 |
| Alpine:v3.24 | perl-dbi | 1.651-r0 | ALPINE-CVE-2026-14739 |
| Debian:12 | libdbi-perl | 1.643-4+deb12u2 | DEBIAN-CVE-2026-14739 |
| Debian:13 | libdbi-perl | 1.652-2~deb13u1 | DEBIAN-CVE-2026-14739 |
| Debian:14 | libdbi-perl | 1.650-1 | DEBIAN-CVE-2026-14739 |
| Rocky Linux:10 | perl-DBI | 0:1.643-26.el10_2.3 | RLSA-2026:49514 |
| Rocky Linux:8 | perl-DBI | 0:1.641-2.el8_10 | RLSA-2026:62667 |
| Rocky Linux:8 | perl-DBI | 0:1.641-8.module+el8.10.0+40273+66ce089d | RLSA-2026:52772 |
| Rocky Linux:8 | perl-DBI | 0:1.641-8.module+el8.10.0+40273+4d327a6c | RLSA-2026:52772 |
| Rocky Linux:8 | perl-DBI | 0:1.641-8.module+el8.10.0+40273+d479100a | RLSA-2026:52772 |
| Rocky Linux:8 | perl-DBI | 0:1.641-8.module+el8.10.0+40273+0bbde87c | RLSA-2026:52772 |
| Rocky Linux:9 | perl-DBI | 0:1.643-9.el9_8.3 | RLSA-2026:49612 |
| Ubuntu:22.04:LTS | libdbi-perl | no fix listed | UBUNTU-CVE-2026-14739 |
| Ubuntu:24.04:LTS | libdbi-perl | no fix listed | UBUNTU-CVE-2026-14739 |
| Ubuntu:25.10 | libdbi-perl | no fix listed | UBUNTU-CVE-2026-14739 |
| Ubuntu:26.04:LTS | libdbi-perl | no fix listed | UBUNTU-CVE-2026-14739 |
| Ubuntu:26.10 | libdbi-perl | no fix listed | UBUNTU-CVE-2026-14739 |
Affected products (as reported)
Weakness: CWE-787 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H