p PatchFirst

CVE-2026-14740

CVE-2026-14740 · DBI versions before 1.650 for Perl read one byte out-of-bounds in preparse when deleting an initial SQL comment

This page contains facts from public vulnerability sources. Check the original advisory before updating.

DBI versions before 1.650 for Perl read one byte out-of-bounds in preparse when deleting an initial SQL comment. The preparse method normalises SQL and removes comments. When the SQL starts with a comment line, the deletion of that line during normalisation led to an out-of-bounds read by one byte. The result is a fault on memory-hardened builds and nondeterministic newline retention on normal builds.

CVSS 9.1 · Critical · EPSS 0.4% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • dbi

    Versions
    • ≥ 0, < 1.650: Affected (custom)

    Update to 1.650

  • libdbi-perl Debian:12

    Versions
    • 1.643-4
    • 1.643-4+deb12u1
    Affected ranges
    • ECOSYSTEM: < 1.643-4+deb12u2

    Update to 1.643-4+deb12u2

  • libdbi-perl Debian:13

    Versions
    • 1.647-1
    • 1.647-1+deb13u1
    • 1.648-1
    • 1.649-1
    • 1.650-1
    • 1.651-1
    • 1.652-1
    Affected ranges
    • ECOSYSTEM: < 1.652-2~deb13u1

    Update to 1.652-2~deb13u1

  • libdbi-perl Debian:14

    Versions
    • 1.647-1
    • 1.648-1
    • 1.649-1
    Affected ranges
    • ECOSYSTEM: < 1.650-1

    Update to 1.650-1

  • libdbi-perl Ubuntu:Pro:14.04:LTS

    Versions
    • 1.627-1
    • 1.628-1
    • 1.630-1
    • 1.630-1ubuntu0.1~esm1
    • 1.630-1ubuntu0.1~esm4
    • 1.630-1ubuntu0.1~esm5
    • 1.630-1ubuntu0.1~esm6
    • 1.630-1ubuntu0.1~esm8
    • 1.630-1ubuntu0.1~esm9
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libdbi-perl Ubuntu:Pro:16.04:LTS

    Versions
    • 1.633-1
    • 1.634-1
    • 1.634-1build1
    • 1.634-1ubuntu0.1
    • 1.634-1ubuntu0.2
    • 1.634-1ubuntu0.2+esm1
    • 1.634-1ubuntu0.2+esm2
    • 1.634-1ubuntu0.2+esm4
    • 1.634-1ubuntu0.2+esm5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libdbi-perl Ubuntu:Pro:18.04:LTS

    Versions
    • 1.637-1
    • 1.639-1
    • 1.640-1
    • 1.640-1ubuntu0.1
    • 1.640-1ubuntu0.2
    • 1.640-1ubuntu0.3
    • 1.640-1ubuntu0.3+esm1
    • 1.640-1ubuntu0.3+esm3
    • 1.640-1ubuntu0.3+esm4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libdbi-perl Ubuntu:Pro:20.04:LTS

    Versions
    • 1.642-1
    • 1.642-1build1
    • 1.643-1
    • 1.643-1ubuntu0.1
    • 1.643-1ubuntu0.1+esm1
    • 1.643-1ubuntu0.1+esm3
    • 1.643-1ubuntu0.1+esm4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libdbi-perl Ubuntu:22.04:LTS

    Versions
    • 1.643-3build2
    • 1.643-3build3
    • 1.643-3ubuntu0.1
    • 1.643-3ubuntu0.3
    • 1.643-3ubuntu0.4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libdbi-perl Ubuntu:24.04:LTS

    Versions
    • 1.643-4
    • 1.643-4build1
    • 1.643-4build2
    • 1.643-4build3
    • 1.643-4ubuntu0.1
    • 1.643-4ubuntu0.3
    • 1.643-4ubuntu0.4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libdbi-perl Ubuntu:25.10

    Versions
    • 1.647-1
    • 1.647-1ubuntu0.25.10.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libdbi-perl Ubuntu:26.10

    Versions
    • 1.647-1build1
    • 1.648-1
    • 1.651-1
    • 1.652-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libdbi-perl Ubuntu:26.04:LTS

    Versions
    • 1.647-1
    • 1.647-1build1
    • 1.647-1ubuntu0.26.04.1
    • 1.647-1ubuntu0.26.04.3
    • 1.647-1ubuntu0.26.04.4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →