CVE catalog

CVE-2026-88816

Perl DBI module vulnerabilities

[CVE catalog]

Severity
Critical · CVSS 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.39% · Oct 25, 2026

DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in FetchHashKeyName. fetchrow_hashref uses the string pointer of the FetchHashKeyName attribute as the key name without stringifying it first. When FetchHashKeyName has been set to an integer (IV) or floating-point (NV) value, that pointer is invalid, so reading the key name triggers a segmentation fault. This can be triggered with the following code: my $dbh = DBI->connect( "dbi:ExampleP:", "", "", { RaiseError => 0, PrintError => 0 } ); $dbh->{FetchHashKeyName} = 42; my $sth = $dbh->prepare("select mode, size, name from ."); $sth->execute; $sth->fetchrow_hashref;

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibdbi-perlsid1.656-1fixed
Debianlibdbi-perlforky1.656-1fixed
Debianlibdbi-perltrixie1.652-2~deb13u1vulnerable
Debianlibdbi-perltrixie-security1.652-2~deb13u1vulnerable
Debianlibdbi-perlbookworm1.643-4+deb12u1vulnerable
Debianlibdbi-perlbookworm-security1.643-4+deb12u3fixed
Ubuntulibdbi-perlnoble1.643-4ubuntu0.4fixed
Ubuntulibdbi-perlpro1.642-1vulnerable
Ubuntulibdbi-perlpro1.642-1build1vulnerable
Ubuntulibdbi-perlpro1.643-1vulnerable
Ubuntulibdbi-perlpro1.643-1ubuntu0.1vulnerable
Ubuntulibdbi-perlpro1.643-1ubuntu0.1+esm1vulnerable
Ubuntulibdbi-perlpro1.643-1ubuntu0.1+esm3vulnerable
Ubuntulibdbi-perlpro1.643-1ubuntu0.1+esm4fixed
Ubuntulibdbi-perl22.041.643-3build2vulnerable
Ubuntulibdbi-perl22.041.643-3build3vulnerable
Ubuntulibdbi-perl22.041.643-3ubuntu0.1vulnerable
Ubuntulibdbi-perl22.041.643-3ubuntu0.3vulnerable
Ubuntulibdbi-perl22.041.643-3ubuntu0.4fixed
Ubuntulibdbi-perl24.041.643-4vulnerable
Ubuntulibdbi-perl24.041.643-4build1vulnerable
Ubuntulibdbi-perl24.041.643-4build2vulnerable
Ubuntulibdbi-perl24.041.643-4build3vulnerable
Ubuntulibdbi-perl24.041.643-4ubuntu0.1vulnerable
Ubuntulibdbi-perl24.041.643-4ubuntu0.3vulnerable
Ubuntulibdbi-perl24.041.643-4ubuntu0.4fixed
Ubuntulibdbi-perl26.041.647-1vulnerable
Ubuntulibdbi-perl26.041.647-1build1vulnerable
Ubuntulibdbi-perl26.041.647-1ubuntu0.26.04.1vulnerable
Ubuntulibdbi-perl26.041.647-1ubuntu0.26.04.3vulnerable
Ubuntulibdbi-perl26.041.647-1ubuntu0.26.04.4fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibdbi-perlsourcesid1.654-1not yet assignedNot reported[1149042]
Debianlibdbi-perlsourceforky1.654-1not yet assignedNot reported[1149042]
Debianlibdbi-perlsourcetrixie(unfixed)not yet assignedNot reported[1149042]
Debianlibdbi-perlsourcebookworm1.643-4+deb12u3not yet assignedNot reported[1149042]
Ubuntulibdbi-perldebnoble1.643-4ubuntu0.4Not reportedNot reportedNot reported
Ubuntulibdbi-perldebpro1.643-1ubuntu0.1+esm4Not reportedUSN-8912-1Not reported
Ubuntulibdbi-perldeb22.041.643-3ubuntu0.4Not reportedUSN-8912-1Not reported
Ubuntulibdbi-perldeb24.041.643-4ubuntu0.4Not reportedUSN-8912-1Not reported
Ubuntulibdbi-perldeb26.041.647-1ubuntu0.26.04.4Not reportedUSN-8912-1Not reported

[Debian bug #1149042]

Notes

[trixie] libdbi-perl: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libdbi-perl]Affected
    Details (4)

    • 1.643-4+deb12u1 · amd64 · bookworm

      Affected · Fixed: 1.643-4+deb12u3

      usn · libdbi-perl · debian · bookworm; usn · libdbi-perl · debian · 12

    • 1.643-4+deb12u1 · arm64 · bookworm

      Affected · Fixed: 1.643-4+deb12u3

      usn · libdbi-perl · debian · bookworm; usn · libdbi-perl · debian · 12

    • 1.643-4+deb12u2 · amd64 · bookworm-security

      Affected · Fixed: 1.643-4+deb12u3

      usn · libdbi-perl · debian · bookworm; usn · libdbi-perl · debian · 12

    • 1.643-4+deb12u2 · arm64 · bookworm-security

      Affected · Fixed: 1.643-4+deb12u3

      usn · libdbi-perl · debian · bookworm; usn · libdbi-perl · debian · 12

[Debian 13 (Trixie)]

  • [libdbi-perl]Affected
    Details (5)

    • 1.647-1+deb13u1 · amd64 · trixie

      Affected

      usn · libdbi-perl · debian · 13

    • 1.647-1+deb13u1 · arm64 · trixie

      Affected

      usn · libdbi-perl · debian · 13

    • 1.647-1+deb13u1 · amd64 · trixie-security · Historical version

      Affected

      usn · libdbi-perl · debian · 13

    • 1.652-2~deb13u1 · amd64 · trixie-security

      Affected

      usn · libdbi-perl · debian · 13

    • 1.652-2~deb13u1 · arm64 · trixie-security

      Affected

      usn · libdbi-perl · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]