CVE-2026-9698 Details
Description
DBI versions before 1.648 for Perl saved errors in a limited-sized buffer. Error messages that were returned when RaiseError, PrintError or HandleError were set were written to a 200-byte buffer without a length limit. Attackers that can influence the error text in an application can trigger a buffer overflow.
A buffer overflow vulnerability has been identified in the DBI module for Perl, specifically in versions prior to 1.648. The issue arises because error messages generated when the RaiseError, PrintError, or HandleError attributes are enabled are written to a buffer limited to 200 bytes, without proper length validation. This flaw can be exploited by attackers who can manipulate the error text within an application, potentially leading to memory corruption.
Users can upgrade to DBI version 1.648 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://access.redhat.com/errata/RHSA-2026:38512 | redhat-SADP | |
| https://access.redhat.com/errata/RHSA-2026:38513 | redhat-SADP | |
| https://access.redhat.com/errata/RHSA-2026:38901 | redhat-SADP | |
| https://access.redhat.com/errata/RHSA-2026:53371 | redhat-SADP | |
| https://access.redhat.com/errata/RHSA-2026:62667 | redhat-SADP | |
| https://access.redhat.com/security/cve/CVE-2026-9698 | redhat-SADP | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2486734 | redhat-SADP | |
| https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-9698.json | redhat-SADP | |
| https://github.com/perl5-dbi/dbi/commit/bfe5d73c162d2d1f761a639a0aa33aad6a9eb54e.patch | CPANSec | Patch |
| https://metacpan.org/release/HMBRAND/DBI-1.648/changes | CPANSec | Release Notes |
| http://www.openwall.com/lists/oss-security/2026/06/09/9 | CVE | Mailing ListThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-120 | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') | redhat-SADP |
| CWE-787 | Out-of-bounds Write | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| perl dbi | < 1.648 |
CPE
Remediation
| |
Change History
16 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 3, 2026 | CVE Modified | CPANSec |
| Sep 3, 2026 | CVE Modified | redhat-SADP |
| Sep 3, 2026 | CVE Modified | CVE |
| Aug 11, 2026 | CVE Modified | redhat-SADP |
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jul 16, 2026 | CVE Modified | redhat-SADP |
| Jul 15, 2026 | CVE Modified | redhat-SADP |
| Jul 14, 2026 | CVE Modified | redhat-SADP |
| Jul 13, 2026 | CVE Modified | redhat-SADP |
| Jun 30, 2026 | CVE Modified | redhat-SADP |
| Jun 17, 2026 | CVE Modified | CPANSec |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 9, 2026 | Initial Analysis | [email protected] |
| Jun 9, 2026 | CVE Modified | CISA-ADP |
| Jun 9, 2026 | CVE Modified | CVE |
| Jun 9, 2026 | New CVE Received | CPANSec |