PT-2026-56273 · Hmbrand · Dbi

H.Merijn Brand + 1 · Published 2026-07-07 · Updated 2026-07-08 · CVE-2026-14739

Mitre

DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders.

The fix for CVE-2026-10879 did not allocate enough memory to handle approximately 1.2-million placeholders.

DBI version 1.650 sets a hard limit of 99,999 placeholders.

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2026-14739

Affected Products

Dbi

References · 6

• https://github.com/perl5-dbi/dbi/commit/2b77c88b655e9539a592c71a61fb965fc0075395.patch · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-14739 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-10879 · Security Note
• https://twitter.com/CVEnew/status/2074643366126760176 · Twitter Post
• https://twitter.com/infoflowcloud/status/2074645010784326052 · Twitter Post
• https://metacpan.org/release/HMBRAND/DBI-1.650/changes · Note