CVE-2026-14739

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-14739", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "state": "PUBLISHED", "assignerShortName": "CPANSec", "dateReserved": "2026-07-04T09:24:31.098Z", "datePublished": "2026-07-07T22:05:18.457Z", "dateUpdated": "2026-07-08T13:56:43.597Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "DBI", "product": "DBI", "programFiles": ["DBI.xs"], "programRoutines": [{"name": "preparse"}], "repo": "https://github.com/perl5-dbi/dbi", "vendor": "HMBRAND", "versions": [{"lessThan": "1.650", "status": "affected", "version": "0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders.\n\nThe fix for CVE-2026-10879 did not allocate enough memory to handle approximately 1.2-million placeholders.\n\nDBI version 1.650 sets a hard limit of 99,999 placeholders."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-07-07T22:05:18.457Z"}, "references": [{"tags": ["patch"], "url": "https://github.com/perl5-dbi/dbi/commit/2b77c88b655e9539a592c71a61fb965fc0075395.patch"}, {"tags": ["vendor-advisory", "related"], "url": "https://www.cve.org/CVERecord?id=CVE-2026-10879"}, {"tags": ["release-notes"], "url": "https://metacpan.org/release/HMBRAND/DBI-1.650/changes"}], "solutions": [{"lang": "en", "value": "Upgrade to DBI version 1.650 or later."}], "source": {"discovery": "UNKNOWN"}, "timeline": [{"lang": "en", "time": "2026-06-04T00:00:00.000Z", "value": "Version 1.648 released with a fix for CVE-2026-10879."}, {"lang": "en", "time": "2026-07-07T00:00:00.000Z", "value": "Version 1.650 released."}], "title": "DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders", "x_generator": {"engine": "cpansec-cna-tool 0.1"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-07-08T13:55:38.504631Z", "id": "CVE-2026-14739", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-08T13:56:43.597Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-14739", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-08T13:55:38.504631Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-08T13:56:39.817Z"}}], "cna": {"title": "DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders", "source": {"discovery": "UNKNOWN"}, "affected": [{"repo": "https://github.com/perl5-dbi/dbi", "vendor": "HMBRAND", "product": "DBI", "versions": [{"status": "affected", "version": "0", "lessThan": "1.650", "versionType": "custom"}], "packageName": "DBI", "programFiles": ["DBI.xs"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "preparse"}]}], "timeline": [{"lang": "en", "time": "2026-06-04T00:00:00.000Z", "value": "Version 1.648 released with a fix for CVE-2026-10879."}, {"lang": "en", "time": "2026-07-07T00:00:00.000Z", "value": "Version 1.650 released."}], "solutions": [{"lang": "en", "value": "Upgrade to DBI version 1.650 or later."}], "references": [{"url": "https://github.com/perl5-dbi/dbi/commit/2b77c88b655e9539a592c71a61fb965fc0075395.patch", "tags": ["patch"]}, {"url": "https://www.cve.org/CVERecord?id=CVE-2026-10879", "tags": ["vendor-advisory", "related"]}, {"url": "https://metacpan.org/release/HMBRAND/DBI-1.650/changes", "tags": ["release-notes"]}], "x_generator": {"engine": "cpansec-cna-tool 0.1"}, "descriptions": [{"lang": "en", "value": "DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders.\n\nThe fix for CVE-2026-10879 did not allocate enough memory to handle approximately 1.2-million placeholders.\n\nDBI version 1.650 sets a hard limit of 99,999 placeholders."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-07-07T22:05:18.457Z"}}}, "cveMetadata": {"cveId": "CVE-2026-14739", "state": "PUBLISHED", "dateUpdated": "2026-07-08T13:56:43.597Z", "dateReserved": "2026-07-04T09:24:31.098Z", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "datePublished": "2026-07-07T22:05:18.457Z", "assignerShortName": "CPANSec"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "DBI", "product": "DBI", "programFiles": ["DBI.xs"], "programRoutines": [{"name": "preparse"}], "repo": "https://github.com/perl5-dbi/dbi", "vendor": "HMBRAND", "versions": [{"lessThan": "1.650", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:perl:dbi:*:*:*:*:*:*:*:*", "matchCriteriaId": "3B8C837F-7D3B-4D47-B604-6927920CDF73", "versionEndExcluding": "1.650", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders.\n\nThe fix for CVE-2026-10879 did not allocate enough memory to handle approximately 1.2-million placeholders.\n\nDBI version 1.650 sets a hard limit of 99,999 placeholders."}, {"lang": "es", "value": "Las versiones de DBI anteriores a la 1.650 para Perl tienen un desbordamiento de mont\u00edculo al preanalizar sentencias SQL con un n\u00famero extremo de marcadores de posici\u00f3n.\n\nLa correcci\u00f3n para CVE-2026-10879 no asign\u00f3 suficiente memoria para manejar aproximadamente 1.2 millones de marcadores de posici\u00f3n.\n\nLa versi\u00f3n 1.650 de DBI establece un l\u00edmite estricto de 99.999 marcadores de posici\u00f3n."}], "id": "CVE-2026-14739", "lastModified": "2026-10-25T20:10:00.147", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-14739", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-07-08T13:55:38.504631Z", "version": "2.0.3"}}]}, "published": "2026-07-07T23:16:54.090", "references": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "tags": ["Patch"], "url": "https://github.com/perl5-dbi/dbi/commit/2b77c88b655e9539a592c71a61fb965fc0075395.patch"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "tags": ["Release Notes"], "url": "https://metacpan.org/release/HMBRAND/DBI-1.650/changes"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "tags": ["Not Applicable"], "url": "https://www.cve.org/CVERecord?id=CVE-2026-10879"}], "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "type": "Secondary"}]}

{"bugzilla": {"description": "DBI: DBI: Heap overflow when preparsing SQL statements with excessive placeholders", "id": "2497916", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497916"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-131", "details": ["DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders.\nThe fix for CVE-2026-10879 did not allocate enough memory to handle approximately 1.2-million placeholders.\nDBI version 1.650 sets a hard limit of 99,999 placeholders.", "A flaw was found in DBI for Perl. This vulnerability, a heap overflow, occurs when the software attempts to preparse SQL statements containing an extremely large number of placeholders. This could allow a remote attacker to cause a denial of service or potentially execute arbitrary code."], "mitigation": {"lang": "en:us", "value": "Applications utilizing `perl-DBI` should implement robust input validation and limit the number of parameters used in SQL query placeholders, particularly when processing untrusted data. This operational control can prevent the construction of SQL statements with an excessive number of placeholders, thereby reducing the risk of triggering the heap overflow vulnerability."}, "name": "CVE-2026-14739", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "perl-DBI", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Affected", "package_name": "perl-DBI", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "perl-DBI", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "perl-DBI", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "perl-DBI:1.641/perl-DBI", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "perl-DBI", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-07-07T22:05:18Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-14739\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-14739\nhttps://github.com/perl5-dbi/dbi/commit/2b77c88b655e9539a592c71a61fb965fc0075395.patch\nhttps://metacpan.org/release/HMBRAND/DBI-1.650/changes\nhttps://www.cve.org/CVERecord?id=CVE-2026-10879"], "statement": "This vulnerability in DBI for Perl is rated as Important. A heap overflow can occur when processing SQL statements with an exceptionally large number of placeholders, potentially leading to a denial of service or arbitrary code execution. While requiring an extreme number of placeholders, this flaw could impact applications utilizing DBI in Red Hat environments that handle untrusted or maliciously crafted SQL queries.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.650)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "DBI", "source": "cna", "vendor": "HMBRAND"}, "product": "dbi", "vendor": "hmbrand"}], "created": "2026-07-07T23:30:16.837821+00:00", "updated": "2026-07-31T14:15:03.883225+00:00", "vendors": ["hmbrand", "hmbrand$PRODUCT$dbi"]}