Описание
DBI versions before 1.648 for Perl have a heap overflow when preparsing SQL statements with more than 9 binders.
The preparse method expands SQL placeholder characters to numbered binders of the form :pN, but only allocates three characters per binder in the buffer. Placeholders 10-99 require four characters, 100-999 require five characters, et cetera.
A flaw was found in perl-DBI. A heap overflow vulnerability exists when preparsing SQL statements with more than 9 binders. The preparse method incorrectly allocates buffer space for SQL placeholder characters, leading to an overflow when processing binders with two or more digits. This can result in a denial of service or potentially arbitrary code execution.
Отчет
A heap buffer overflow flaw of important severity was found in the perl-DBI Perl database interface module, affecting the perl-DBI packages in Red Hat Enterprise Linux 6, 7, 8, 9, and 10 (including the perl-DBI:1.641 module streams on RHEL 8) and in Red Hat In-Vehicle OS. When the DBI preparse method rewrites a SQL statement containing ? placeholders, each placeholder is expanded to a numbered binder of the form :pN, but the destination buffer was allocated assuming only three characters per binder. A statement with more than 9 placeholders generates binders with two or more digits (for example :p1003), so the expanded statement can exceed the allocated buffer and overflow the heap. An attacker who can influence a SQL statement that an application using the vulnerable preparse path prepares could exploit this to crash the application, causing a denial of service, or potentially achieve memory corruption leading to arbitrary code execution. Red Hat rates this flaw as IMPORTANT with a CVSS 3.1 score of 7.7 (AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H), lower than the CISA score of 9.8 that assumes a network attack vector, because exploitation requires a local application to pass attacker-controlled SQL through the affected preparse code path rather than direct network exposure of the flaw itself, and Red Hat's scoring reflects no direct confidentiality impact. The affected Red Hat Enterprise Linux and Red Hat In-Vehicle OS streams are tracked as AFFECTED, with fixes being pursued for those streams; Fedora is not affected because the vulnerable code is not present in its perl-DBI packages.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | perl-DBI | Affected | ||
| Red Hat Enterprise Linux 7 | perl-DBI | Affected | ||
| Red Hat Enterprise Linux 10 | perl-DBI | Fixed | RHSA-2026:38513 | 13.07.2026 |
| Red Hat Enterprise Linux 8 | perl-DBI | Fixed | RHSA-2026:38901 | 13.07.2026 |
| Red Hat Enterprise Linux 8 | perl-DBI | Fixed | RHSA-2026:62667 | 02.09.2026 |
| Red Hat Enterprise Linux 9 | perl-DBI | Fixed | RHSA-2026:38512 | 13.07.2026 |
| Red Hat Insights proxy 1.5 | insights-proxy/insights-proxy-container-rhel9 | Fixed | RHSA-2026:53371 | 11.08.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
7.7 High
CVSS3
Связанные уязвимости
DBI versions before 1.648 for Perl have a heap overflow when preparsing SQL statements with more than 9 binders. The preparse method expands SQL placeholder characters to numbered binders of the form :pN, but only allocates three characters per binder in the buffer. Placeholders 10-99 require four characters, 100-999 require five characters, et cetera.
DBI versions before 1.648 for Perl have a heap overflow when preparsing SQL statements with more than 9 binders. The preparse method expands SQL placeholder characters to numbered binders of the form :pN, but only allocates three characters per binder in the buffer. Placeholders 10-99 require four characters, 100-999 require five characters, et cetera.
DBI versions before 1.648 for Perl have a heap overflow when preparsing SQL statements with more than 9 binders
DBI versions before 1.648 for Perl have a heap overflow when preparsin ...
DBI versions before 1.648 for Perl have a heap overflow when preparsing SQL statements with more than 9 binders. The preparse method expands SQL placeholder characters to numbered binders of the form :pN, but only allocates three characters per binder in the buffer. Placeholders 10-99 require four characters, 100-999 require five characters, et cetera.
EPSS
7.7 High
CVSS3