Log in Start free

Vulnerability · Published Sep 28, 2026 · Assigned by CPANSec

CVE-2026-88816DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in FetchHashKeyName

High 7.5

In plain English

A high-severity type confusion in DBI. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.4%top 67.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in FetchHashKeyName. fetchrow_hashref uses the string pointer of the FetchHashKeyName attribute as the key name without stringifying it first. When FetchHashKeyName has been set to an integer (IV) or floating-point (NV) value, that pointer is invalid, so reading the key name triggers a segmentation fault. This can be triggered with the following code: my $dbh = DBI->connect( "dbi:ExampleP:", "", "", { RaiseError => 0, PrintError => 0 } ); $dbh->{FetchHashKeyName} = 42; my $sth = $dbh->prepare("select mode, size, name from ."); $sth->execute; $sth->fetchrow_hashref;

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12libdbi-perl1.643-4+deb12u3DEBIAN-CVE-2026-88816
Debian:13libdbi-perlno fix listedDEBIAN-CVE-2026-88816
Debian:14libdbi-perl1.654-1DEBIAN-CVE-2026-88816
Ubuntu:22.04:LTSlibdbi-perl1.643-3ubuntu0.4UBUNTU-CVE-2026-88816
Ubuntu:22.04:LTSlibdbi-perl1.643-3ubuntu0.4USN-8912-1
Ubuntu:24.04:LTSlibdbi-perl1.643-4ubuntu0.4USN-8912-1
Ubuntu:24.04:LTSlibdbi-perl1.643-4ubuntu0.4UBUNTU-CVE-2026-88816
Ubuntu:26.04:LTSlibdbi-perl1.647-1ubuntu0.26.04.4USN-8912-1
Ubuntu:26.04:LTSlibdbi-perl1.647-1ubuntu0.26.04.4UBUNTU-CVE-2026-88816
Ubuntu:26.10libdbi-perlno fix listedUBUNTU-CVE-2026-88816

Affected products (as reported)

VendorProductVersions
DBI 0 – before 1.654

Weakness: CWE-843 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References