CVE-2026-60082
DBI versions before 1.651 for Perl do not enforce statement handle consistency with the row
- State
- Published
- Severity
- 9.1 Critical
- Published
- Jul 14, 2026
- Updated
- Jul 15, 2026
- Reserved
- Jul 8, 2026
Description
DBI versions before 1.651 for Perl do not enforce statement handle consistency with the row.
When the statement handle had no fields but the source row was non-empty, the internal row-buffer helper would read from a negative array index.
This could be triggered by a caller supplying inconsistent metadata and rows to the prepare method.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 9.1 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H | CISA-ADP |
Weaknesses
- CWE-125 Out-of-bounds Read
Affected Products
| Product | Versions |
|---|---|
DBIHMBRAND |
|
References
- https://github.com/perl5-dbi/dbi/security/advisories/GHSA-rwhc-hhmv-cjvgvendor-advisory
- https://metacpan.org/release/HMBRAND/DBI-1.651/changesrelease-notes
- https://github.com/perl5-dbi/dbi/commit/397868704291bbf0989b97e2c0661189890653e2.patchpatch
- http://www.openwall.com/lists/oss-security/2026/07/14/13
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.