CVE-2026-10879: falha crítica em HMBRAND DBI
DBI versions before 1.648 for Perl have a heap overflow when preparsing SQL statements with more than 9 binders
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.8epss 0.5%
DBI versions before 1.648 for Perl have a heap overflow when preparsing SQL statements with more than 9 binders.
The preparse method expands SQL placeholder characters to numbered binders of the form :pN, but only allocates three characters per binder in the buffer. Placeholders 10-99 require four characters, 100-999 require five characters, et cetera.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
HMBRAND · DBICVEs relacionadas — HMBRAND DBI
No mesmo produto, das mais perigosas para as menos.
CVE-2026-60082CRITICALDBI versions before 1.651 for Perl do not enforce statement handle consistency with the rowEPSS 0.7%CVE-2026-9698HIGHDBI versions before 1.648 for Perl saved errors in a limited-sized bufferEPSS 0.5%CVE-2026-14739CRITICALDBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholdersEPSS 0.4%CVE-2026-14740CRITICALDBI versions before 1.650 for Perl read one byte out-of-bounds in preparse when deleting an initial SQL commentEPSS 0.4%