Vulnerability · Published Jun 9, 2026 · Assigned by CPANSec

CVE-2026-9698DBI versions before 1.648 for Perl saved errors in a limited-sized buffer

High 7.5

In plain English

A high-severity out-of-bounds write in DBI from HMBRAND. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.5%top 59.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

DBI versions before 1.648 for Perl saved errors in a limited-sized buffer. Error messages that were returned when RaiseError, PrintError or HandleError were set were written to a 200-byte buffer without a length limit. Attackers that can influence the error text in an application can trigger a buffer overflow.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
AlmaLinux:10	perl-DBI	1.643-26.el10_2.1	ALSA-2026:38513
AlmaLinux:8	perl-DBI	1.641-5.module_el8.10.0+4219+13f48a6e	ALSA-2026:38901
AlmaLinux:8	perl-DBI	1.641-5.module_el8.10.0+4220+8669cc49	ALSA-2026:38901
AlmaLinux:8	perl-DBI	1.641-5.module_el8.10.0+4218+c616d9bd	ALSA-2026:38901
AlmaLinux:8	perl-DBI	1.641-2.el8_10	ALSA-2026:62667
AlmaLinux:9	perl-DBI	1.643-9.el9_8.1	ALSA-2026:38512
Alpine:v3.24	perl-dbi	1.648-r0	ALPINE-CVE-2026-9698
Debian:12	libdbi-perl	1.643-4+deb12u1	DEBIAN-CVE-2026-9698
Debian:13	libdbi-perl	1.647-1+deb13u1	DEBIAN-CVE-2026-9698
Debian:14	libdbi-perl	1.648-1	DEBIAN-CVE-2026-9698
Rocky Linux:10	perl-DBI	0:1.643-26.el10_2.1	RLSA-2026:38513
Rocky Linux:8	perl-DBI	0:1.641-2.el8_10	RLSA-2026:62667
Rocky Linux:8	perl-DBI	0:1.641-5.module+el8.10.0+40245+1df7f06b	RLSA-2026:38901
Rocky Linux:9	perl-DBI	0:1.643-9.el9_8.1	RLSA-2026:38512
Ubuntu:22.04:LTS	libdbi-perl	1.643-3ubuntu0.1	UBUNTU-CVE-2026-9698
Ubuntu:24.04:LTS	libdbi-perl	1.643-4ubuntu0.1	UBUNTU-CVE-2026-9698
Ubuntu:25.10	libdbi-perl	1.647-1ubuntu0.25.10.1	UBUNTU-CVE-2026-9698
Ubuntu:26.04:LTS	libdbi-perl	1.647-1ubuntu0.26.04.1	UBUNTU-CVE-2026-9698

Affected products (as reported)

Vendor	Product	Versions
HMBRAND	DBI	0 – before 1.648

Weakness: CWE-787, CWE-120 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://metacpan.org/release/HMBRAND/DBI-1.648/changes release-notes
https://github.com/perl5-dbi/dbi/commit/bfe5d73c162d2d1f761a639a0aa33aad6a9eb54e.patch patch
http://www.openwall.com/lists/oss-security/2026/06/09/9
https://access.redhat.com/security/cve/CVE-2026-9698 vdb-entry, x_refsource_REDHAT
RHBZ#2486734 issue-tracking, x_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-9698.json x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:38513 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:38901 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:38512 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:62667 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:53371 vendor-advisory, x_refsource_REDHAT