by Kastro
Paper/Archive/CVE-2026-60082

CVE-2026-60082

HMBRAND DBI — DBI versions before 1.651 for Perl do not enforce statement handle consistency with the row

EPSS 0.7%CVSS 9.1
critical.is priorityof 100
38
CVSS 9.1 (ADP)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 51.3.513 × 2010.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

DBI versions before 1.651 for Perl do not enforce statement handle consistency with the row. When the statement handle had no fields but the source row was non-empty, the internal row-buffer helper would read from a negative array index. This could be triggered by a caller supplying inconsistent metadata and rows to the prepare method.

Affected

ProductAffectedFixed inSource
DBI< 1.6511.651CNA

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

advisorygithub.com/perl5-dbi/dbi/security/advisories/GHSA-rwhc-hhmv-cjvgrefmetacpan.org/release/HMBRAND/DBI-1.651/changespatchgithub.com/perl5-dbi/dbi/commit/397868704291bbf0989b97e2c0661189890653e2.patchrefopenwall.com/lists/oss-security/2026/07/14/13