CVE-2026-60082 PUBLISHED

DBI versions before 1.651 for Perl do not enforce statement handle consistency with the row

Assigner: CPANSec
Reserved: 08.07.2026 Published: 14.07.2026 Updated: 14.07.2026

DBI versions before 1.651 for Perl do not enforce statement handle consistency with the row.

When the statement handle had no fields but the source row was non-empty, the internal row-buffer helper would read from a negative array index.

This could be triggered by a caller supplying inconsistent metadata and rows to the prepare method.

Product Status

Vendor HMBRAND
Product DBI
Versions Default: unaffected
  • affected from 0 to 1.651 (excl.)

Solutions

Upgrade to version 1.651 or later.

References

Problem Types

  • CWE-125 Out-of-bounds Read CWE