CVE-2026-14739 Details
Description
DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders. The fix for CVE-2026-10879 did not allocate enough memory to handle approximately 1.2-million placeholders. DBI version 1.650 sets a hard limit of 99,999 placeholders.
A heap overflow vulnerability has been identified in DBI versions prior to 1.650 for Perl. This issue arises when SQL statements containing an excessive number of placeholders are preparsed. The vulnerability occurs because the memory allocated to handle the placeholders is insufficient for statements with approximately 1.2 million placeholders. While DBI version 1.650 introduces a hard limit of 99,999 placeholders, earlier versions lack this restriction, allowing for the overflow.
Users can upgrade to DBI version 1.650 or later, where the vulnerability has been addressed by setting a hard limit on the number of placeholders.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/perl5-dbi/dbi/commit/2b77c88b655e9539a592c71a61fb965fc0075395.patch | CPANSec | Patch |
| https://metacpan.org/release/HMBRAND/DBI-1.650/changes | CPANSec | Release Notes |
| https://www.cve.org/CVERecord?id=CVE-2026-10879 | CPANSec | Not Applicable |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-787 | Out-of-bounds Write | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| perl dbi | < 1.650 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 10, 2026 | Initial Analysis | [email protected] |
| Jul 8, 2026 | CVE Modified | CISA-ADP |
| Jul 7, 2026 | New CVE Received | CPANSec |