CVE-2026-73194 PUBLISHED

DBI versions before 1.652 for Perl allow a heap out-of-bounds write via an unvalidated numeric placeholder that sets the binder counter in preparse

Assigner: CPANSec
Reserved: 11.08.2026 Published: 15.08.2026 Updated: 15.08.2026

DBI versions before 1.652 for Perl allow a heap out-of-bounds write via an unvalidated numeric placeholder that sets the binder counter in preparse.

preparse reserves seven output bytes per input byte, the width of the longest ':p99999' expansion. The ':N' branch parses the number with atoi(src) and assigns it to the binder counter with no range check, so a statement containing ':2147483648' leaves the counter negative (-2147483648 with glibc, where atoi wraps). Each following '?' then expands through sprintf(start, ":p%d", idx++) to ':p-2147483648', 14 bytes with the terminating NUL where the buffer budgets 7. The placeholder limit added in 1.650 tests the counter against 99,999, which a negative counter passes.

Any caller that preparses an untrusted statement into ':pN' style placeholders gets a heap out-of-bounds write that grows with the number of '?' marks following the poisoned placeholder. The '?' and '%s' return styles compare the parsed number against the expected sequence and error out, and are unaffected.

Product Status

Package Collection https://cpan.org/modules
Package Name DBI
Versions Default: unaffected
  • affected from 0 to 1.652 (excl.)

Workarounds

For deployments that cannot be upgraded, limit SQL statements to 99,999 placeholders.

Solutions

Upgrade to DBI 1.652 or later.

Credits

  • Harsh Raj Singhania finder

References

Problem Types

  • CWE-1284 Improper Validation of Specified Quantity in Input CWE
  • CWE-787 Out-of-bounds Write CWE