p PatchFirst

CVE-2026-14739

CVE-2026-14739 · DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders

This page contains facts from public vulnerability sources. Check the original advisory before updating.

DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders. The fix for CVE-2026-10879 did not allocate enough memory to handle approximately 1.2-million placeholders. DBI version 1.650 sets a hard limit of 99,999 placeholders.

CVSS 9.8 · Critical · EPSS 0.4% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • dbi

    Versions
    • ≥ 0, < 1.650: Affected (custom)

    Update to 1.650

  • libdbi-perl Debian:12

    Versions
    • 1.643-4
    • 1.643-4+deb12u1
    Affected ranges
    • ECOSYSTEM: < 1.643-4+deb12u2

    Update to 1.643-4+deb12u2

  • libdbi-perl Debian:13

    Versions
    • 1.647-1
    • 1.647-1+deb13u1
    • 1.648-1
    • 1.649-1
    • 1.650-1
    • 1.651-1
    • 1.652-1
    Affected ranges
    • ECOSYSTEM: < 1.652-2~deb13u1

    Update to 1.652-2~deb13u1

  • libdbi-perl Debian:14

    Versions
    • 1.647-1
    • 1.648-1
    • 1.649-1
    Affected ranges
    • ECOSYSTEM: < 1.650-1

    Update to 1.650-1

  • libdbi-perl Ubuntu:Pro:14.04:LTS

    Versions
    • 1.627-1
    • 1.628-1
    • 1.630-1
    • 1.630-1ubuntu0.1~esm1
    • 1.630-1ubuntu0.1~esm4
    • 1.630-1ubuntu0.1~esm5
    • 1.630-1ubuntu0.1~esm6
    • 1.630-1ubuntu0.1~esm8
    • 1.630-1ubuntu0.1~esm9
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libdbi-perl Ubuntu:Pro:16.04:LTS

    Versions
    • 1.633-1
    • 1.634-1
    • 1.634-1build1
    • 1.634-1ubuntu0.1
    • 1.634-1ubuntu0.2
    • 1.634-1ubuntu0.2+esm1
    • 1.634-1ubuntu0.2+esm2
    • 1.634-1ubuntu0.2+esm4
    • 1.634-1ubuntu0.2+esm5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libdbi-perl Ubuntu:Pro:18.04:LTS

    Versions
    • 1.637-1
    • 1.639-1
    • 1.640-1
    • 1.640-1ubuntu0.1
    • 1.640-1ubuntu0.2
    • 1.640-1ubuntu0.3
    • 1.640-1ubuntu0.3+esm1
    • 1.640-1ubuntu0.3+esm3
    • 1.640-1ubuntu0.3+esm4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libdbi-perl Ubuntu:Pro:20.04:LTS

    Versions
    • 1.642-1
    • 1.642-1build1
    • 1.643-1
    • 1.643-1ubuntu0.1
    • 1.643-1ubuntu0.1+esm1
    • 1.643-1ubuntu0.1+esm3
    • 1.643-1ubuntu0.1+esm4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libdbi-perl Ubuntu:22.04:LTS

    Versions
    • 1.643-3build2
    • 1.643-3build3
    • 1.643-3ubuntu0.1
    • 1.643-3ubuntu0.3
    • 1.643-3ubuntu0.4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libdbi-perl Ubuntu:24.04:LTS

    Versions
    • 1.643-4
    • 1.643-4build1
    • 1.643-4build2
    • 1.643-4build3
    • 1.643-4ubuntu0.1
    • 1.643-4ubuntu0.3
    • 1.643-4ubuntu0.4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libdbi-perl Ubuntu:25.10

    Versions
    • 1.647-1
    • 1.647-1ubuntu0.25.10.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libdbi-perl Ubuntu:26.10

    Versions
    • 1.647-1build1
    • 1.648-1
    • 1.651-1
    • 1.652-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libdbi-perl Ubuntu:26.04:LTS

    Versions
    • 1.647-1
    • 1.647-1build1
    • 1.647-1ubuntu0.26.04.1
    • 1.647-1ubuntu0.26.04.3
    • 1.647-1ubuntu0.26.04.4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →