Hmbrand DBI vulnerabilities

5 vulnerabilities

Known vulnerabilities in Hmbrand DBI, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

9.8CVE-2026-9698alpineperl-dbi+14
EPSS score
0.82%
DBI versions before 1.648 for Perl saved errors in a limited-sized buffer. Error messages that were returned when RaiseError, PrintError or HandleError were set were written to a 200-byte buffer without a length limit. Attackers that can influence the error text in an application can trigger a buffer overflow.9.8CVE-2026-14739alpineperl-dbi+4
EPSS score
0.41%
DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders. The fix for CVE-2026-10879 did not allocate enough memory to handle approximately 1.2-million placeholders. DBI version 1.650 sets a hard limit of 99,999 placeholders.9.1CVE-2026-14740alpineperl-dbi+4
EPSS score
0.39%
DBI versions before 1.650 for Perl read one byte out-of-bounds in preparse when deleting an initial SQL comment. The preparse method normalises SQL and removes comments. When the SQL starts with a comment line, the deletion of that line during normalisation led to an out-of-bounds read by one byte. The result is a fault on memory-hardened builds and nondeterministic newline retention on normal builds.9.8CVE-2026-10879alpineperl-dbi+4
EPSS score
0.48%
DBI versions before 1.648 for Perl have a heap overflow when preparsing SQL statements with more than 9 binders. The preparse method expands SQL placeholder characters to numbered binders of the form :pN, but only allocates three characters per binder in the buffer. Placeholders 10-99 require four characters, 100-999 require five characters, et cetera.9.1CVE-2026-60082alpineperl-dbi+3
EPSS score
0.65%
DBI versions before 1.651 for Perl do not enforce statement handle consistency with the row. When the statement handle had no fields but the source row was non-empty, the internal row-buffer helper would read from a negative array index. This could be triggered by a caller supplying inconsistent metadata and rows to the prepare method.