CVE-2026-15043

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-15043", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "state": "PUBLISHED", "assignerShortName": "CPANSec", "dateReserved": "2026-07-08T11:48:00.718Z", "datePublished": "2026-07-14T09:44:25.733Z", "dateUpdated": "2026-07-14T15:32:33.329Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "DBI", "product": "DBI::SQL::Nano", "programFiles": ["lib/DBI/SQL/Nano.pm"], "programRoutines": [{"name": "DBI::SQL::Nano::is_matched"}], "repo": "https://github.com/perl5-dbi/dbi", "vendor": "HMBRAND", "versions": [{"lessThan": "1.651", "status": "affected", "version": "1.42", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "DBI::SQL::Nano versions from 1.42 before 1.651 for Perl have inverted <= and >= SQL operators on text.\n\nDBI::SQL::Nano, DBI's built-in mini-SQL engine, evaluated WHERE predicates incorrectly in some cases. In the non-numeric string branch of the is_matched method, <= was evaluated using Perl's ge operator, and >= was evaluated using Perl's le operator.\n\nSQL::Nano is the fallback query engine for DBI's file-backed drivers (DBD::File, DBD::DBM, CSV-style drivers) whenever SQL::Statement is not installed, and is forced whenever DBI_SQL_NANO=1. Queries over such tables use these predicates directly.\n\nThe impact depends on the context. Where an application relies on a WHERE clause to filter file-backed data for policy or authorization, an inverted <=/>= comparison silently returns the wrong rows."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-480", "description": "CWE-480 Use of Incorrect Operator", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-07-14T15:32:33.329Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://github.com/perl5-dbi/dbi/security/advisories/GHSA-mv45-ff6j-x9jp"}, {"tags": ["release-notes"], "url": "https://metacpan.org/release/HMBRAND/DBI-1.651/changes"}, {"tags": ["patch"], "url": "https://github.com/perl5-dbi/dbi/commit/e9742ef85a75867cbd696860e3bf3e32b681f98d.patch"}], "solutions": [{"lang": "en", "value": "Upgrade to DBI 1.651 or later."}], "source": {"discovery": "UNKNOWN"}, "timeline": [{"lang": "en", "time": "2004-03-12T00:00:00.000Z", "value": "Version 1.42 released with DBI::SQL::Nano."}, {"lang": "en", "time": "2026-07-10T00:00:00.000Z", "value": "Patch that fixes DBI::SQL::Nano merged."}, {"lang": "en", "time": "2026-07-14T00:00:00.000Z", "value": "Version 1.651 released."}], "title": "DBI::SQL::Nano versions from 1.42 before 1.651 for Perl have inverted <= and >= SQL operators on text", "workarounds": [{"lang": "en", "value": "For deployments that cannot upgrade, apply the patch or install SQL::Statement."}], "x_generator": {"engine": "cpansec-cna-tool 0.1"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/07/14/9"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-07-14T11:30:25.876Z"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-07-14T14:14:59.552000Z", "id": "CVE-2026-15043", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-14T14:16:12.284Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/07/14/9"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-07-14T11:30:25.876Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-15043", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-14T14:14:59.552000Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-14T14:14:52.942Z"}}], "cna": {"title": "DBI::SQL::Nano versions from 1.42 before 1.651 for Perl have inverted <= and >= SQL operators on text", "source": {"discovery": "UNKNOWN"}, "affected": [{"repo": "https://github.com/perl5-dbi/dbi", "vendor": "HMBRAND", "product": "DBI::SQL::Nano", "versions": [{"status": "affected", "version": "1.42", "lessThan": "1.651", "versionType": "custom"}], "packageName": "DBI", "programFiles": ["lib/DBI/SQL/Nano.pm"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "DBI::SQL::Nano::is_matched"}]}], "timeline": [{"lang": "en", "time": "2004-03-12T00:00:00.000Z", "value": "Version 1.42 released with DBI::SQL::Nano."}, {"lang": "en", "time": "2026-07-10T00:00:00.000Z", "value": "Patch that fixes DBI::SQL::Nano merged."}, {"lang": "en", "time": "2026-07-14T00:00:00.000Z", "value": "Version 1.651 released."}], "solutions": [{"lang": "en", "value": "Upgrade to DBI 1.651 or later."}], "references": [{"url": "https://github.com/perl5-dbi/dbi/security/advisories/GHSA-mv45-ff6j-x9jp", "tags": ["vendor-advisory"]}, {"url": "https://metacpan.org/release/HMBRAND/DBI-1.651/changes", "tags": ["release-notes"]}, {"url": "https://github.com/perl5-dbi/dbi/commit/e9742ef85a75867cbd696860e3bf3e32b681f98d.patch", "tags": ["patch"]}], "workarounds": [{"lang": "en", "value": "For deployments that cannot upgrade, apply the patch or install SQL::Statement."}], "x_generator": {"engine": "cpansec-cna-tool 0.1"}, "descriptions": [{"lang": "en", "value": "DBI::SQL::Nano versions from 1.42 before 1.651 for Perl have inverted <= and >= SQL operators on text.\n\nDBI::SQL::Nano, DBI's built-in mini-SQL engine, evaluated WHERE predicates incorrectly in some cases. In the non-numeric string branch of the is_matched method, <= was evaluated using Perl's ge operator, and >= was evaluated using Perl's le operator.\n\nSQL::Nano is the fallback query engine for DBI's file-backed drivers (DBD::File, DBD::DBM, CSV-style drivers) whenever SQL::Statement is not installed, and is forced whenever DBI_SQL_NANO=1. Queries over such tables use these predicates directly.\n\nThe impact depends on the context. Where an application relies on a WHERE clause to filter file-backed data for policy or authorization, an inverted <=/>= comparison silently returns the wrong rows."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-480", "description": "CWE-480 Use of Incorrect Operator"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-07-14T15:32:33.329Z"}}}, "cveMetadata": {"cveId": "CVE-2026-15043", "state": "PUBLISHED", "dateUpdated": "2026-07-14T15:32:33.329Z", "dateReserved": "2026-07-08T11:48:00.718Z", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "datePublished": "2026-07-14T09:44:25.733Z", "assignerShortName": "CPANSec"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "DBI", "product": "DBI::SQL::Nano", "programFiles": ["lib/DBI/SQL/Nano.pm"], "programRoutines": [{"name": "DBI::SQL::Nano::is_matched"}], "repo": "https://github.com/perl5-dbi/dbi", "vendor": "HMBRAND", "versions": [{"lessThan": "1.651", "status": "affected", "version": "1.42", "versionType": "custom"}]}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "DBI::SQL::Nano versions from 1.42 before 1.651 for Perl have inverted <= and >= SQL operators on text.\n\nDBI::SQL::Nano, DBI's built-in mini-SQL engine, evaluated WHERE predicates incorrectly in some cases. In the non-numeric string branch of the is_matched method, <= was evaluated using Perl's ge operator, and >= was evaluated using Perl's le operator.\n\nSQL::Nano is the fallback query engine for DBI's file-backed drivers (DBD::File, DBD::DBM, CSV-style drivers) whenever SQL::Statement is not installed, and is forced whenever DBI_SQL_NANO=1. Queries over such tables use these predicates directly.\n\nThe impact depends on the context. Where an application relies on a WHERE clause to filter file-backed data for policy or authorization, an inverted <=/>= comparison silently returns the wrong rows."}, {"lang": "es", "value": "Las versiones de DBI::SQL::Nano desde la 1.42 anteriores a la 1.651 para Perl tienen invertidos los operadores SQL <= y >= en texto.\n\nDBI::SQL::Nano, el motor mini-SQL integrado de DBI, evalu\u00f3 predicados WHERE incorrectamente en algunos casos. En la rama de cadena no num\u00e9rica del m\u00e9todo is_matched, <= se evalu\u00f3 usando el operador ge de Perl, y >= se evalu\u00f3 usando el operador le de Perl.\n\nSQL::Nano es el motor de consulta de respaldo para los controladores de DBI respaldados por archivos (DBD::File, DBD::DBM, controladores de estilo CSV) siempre que SQL::Statement no est\u00e9 instalado, y se fuerza siempre que DBI_SQL_NANO=1. Las consultas sobre dichas tablas usan estos predicados directamente.\n\nEl impacto depende del contexto. Donde una aplicaci\u00f3n depende de una cl\u00e1usula WHERE para filtrar datos respaldados por archivos para pol\u00edticas o autorizaci\u00f3n, una comparaci\u00f3n <=/>= invertida devuelve silenciosamente las filas incorrectas."}], "id": "CVE-2026-15043", "lastModified": "2026-10-24T21:10:00.130", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-15043", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-07-14T14:14:59.552000Z", "version": "2.0.3"}}]}, "published": "2026-07-14T10:16:31.253", "references": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://github.com/perl5-dbi/dbi/commit/e9742ef85a75867cbd696860e3bf3e32b681f98d.patch"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://github.com/perl5-dbi/dbi/security/advisories/GHSA-mv45-ff6j-x9jp"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://metacpan.org/release/HMBRAND/DBI-1.651/changes"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2026/07/14/9"}], "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-480"}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "type": "Secondary"}]}

{"bugzilla": {"description": "DBI::SQL::Nano: DBI::SQL::Nano: Incorrect SQL operator evaluation can lead to incorrect data filtering.", "id": "2499934", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499934"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "status": "draft"}, "cwe": "CWE-480", "details": ["DBI::SQL::Nano versions from 1.42 before 1.651 for Perl have inverted <= and >= SQL operators on text.\nDBI::SQL::Nano, DBI's built-in mini-SQL engine, evaluated WHERE predicates incorrectly in some cases. In the non-numeric string branch of the is_matched method, <= was evaluated using Perl's ge operator, and >= was evaluated using Perl's le operator.\nSQL::Nano is the fallback query engine for DBI's file-backed drivers (DBD::File, DBD::DBM, CSV-style drivers) whenever SQL::Statement is not installed, and is forced whenever DBI_SQL_NANO=1. Queries over such tables use these predicates directly.\nThe impact depends on the context. Where an application relies on a WHERE clause to filter file-backed data for policy or authorization, an inverted <=/>= comparison silently returns the wrong rows.", "A flaw was found in DBI::SQL::Nano, a mini-SQL engine for Perl. This vulnerability occurs because the engine incorrectly evaluates SQL operators for text comparisons, specifically inverting the logic for \"less than or equal to\" and \"greater than or equal to\" operations. This can lead to applications that rely on these comparisons for filtering data, such as for policy or authorization, silently returning incorrect results. The impact of this flaw depends on how an application uses these SQL queries."], "name": "CVE-2026-15043", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "perl-DBI", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "perl-DBI", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "perl-DBI", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "perl-DBI", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "perl-DBI:1.641/perl-DBI", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "perl-DBI", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-07-14T09:44:25Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-15043\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-15043\nhttps://github.com/perl5-dbi/dbi/commit/e9742ef85a75867cbd696860e3bf3e32b681f98d.patch\nhttps://github.com/perl5-dbi/dbi/security/advisories/GHSA-mv45-ff6j-x9jp"], "statement": "A Moderate impact flaw in perl-DBI's SQL::Nano engine can lead to incorrect data filtering. This issue arises when applications use file-backed drivers with SQL::Nano as the fallback SQL engine, causing text comparison operators (`<=` and `>=`) to be inverted. This could result in applications silently returning incorrect data, potentially affecting policy enforcement or authorization decisions.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[1.42,1.651)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "DBI::SQL::Nano", "source": "cna", "vendor": "HMBRAND"}, "product": "dbi::sql::nano", "vendor": "hmbrand"}], "created": "2026-07-16T07:45:05.176505+00:00", "updated": "2026-08-01T10:15:03.451563+00:00", "vendors": ["hmbrand", "hmbrand$PRODUCT$dbi::sql::nano"]}