CVE-2026-10879 DBI versions before 1.648 for Perl have a heap overflow when preparsing SQL statements with more than 9 binders
Heap overflow in Perl DBI allows attackers to execute arbitrary code or cause denial of service via SQL statements with many binders.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-10879?
CVE-2026-10879 is a critical memory corruption vulnerability in HMBRAND DBI, published on 5 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
DBI versions before 1.648 for Perl have a heap overflow when preparsing SQL statements with more than 9 binders.
The preparse method expands SQL placeholder characters to numbered binders of the form :pN, but only allocates three characters per binder in the buffer. Placeholders 10-99 require four characters, 100-999 require five characters, et cetera.
Weakness: CWE-787
Which versions are affected by CVE-2026-10879?
It affects 1 product.
Products include Perl Dbi.
How do I fix CVE-2026-10879?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-10879 being exploited?
There is no known exploitation of CVE-2026-10879 in the wild and no public exploit code.
Other vulnerabilities in HMBRAND DBI
- CVE-2026-14739 Memory corruption in DBI
- CVE-2026-14740 DBI versions before 1.650 for Perl read one byte out-of-bounds in preparse when deleting an initial SQL comment
- CVE-2026-14380 DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile
- CVE-2026-9698 DBI versions before 1.648 for Perl saved errors in a limited-sized buffer
- CVE-2014-10402 Path traversal in n/a
Sources
Also known as ALPINE-CVE-2026-10879, AZL-89559, BELL-CVE-2026-10879, DEBIAN-CVE-2026-10879, ECHO-289f-c6b8-0d5e, GHSA-c7xw-cj86-m724.