CVE-2026-14739 Memory corruption in DBI
Heap overflow in Perl DBI allows attackers to cause denial of service or execute code via SQL statements with excessive placeholders.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-14739?
CVE-2026-14739 is a critical memory corruption vulnerability in HMBRAND DBI, published on 7 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders.
The fix for CVE-2026-10879 did not allocate enough memory to handle approximately 1.2-million placeholders.
DBI version 1.650 sets a hard limit of 99,999 placeholders.
Weakness: CWE-787
Which versions are affected by CVE-2026-14739?
It affects 1 product.
Products include Perl Dbi.
How do I fix CVE-2026-14739?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-14739 being exploited?
There is no known exploitation of CVE-2026-14739 in the wild and no public exploit code.
Other vulnerabilities in HMBRAND DBI
- CVE-2026-10879 DBI versions before 1.648 for Perl have a heap overflow when preparsing SQL statements with more than 9 binders
- CVE-2026-14740 DBI versions before 1.650 for Perl read one byte out-of-bounds in preparse when deleting an initial SQL comment
- CVE-2026-14380 DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile
- CVE-2026-9698 DBI versions before 1.648 for Perl saved errors in a limited-sized buffer
- CVE-2014-10402 Path traversal in n/a
Sources
Also known as ALPINE-CVE-2026-14739, AZL-92202, BELL-CVE-2026-14739, DEBIAN-CVE-2026-14739, ECHO-a14b-4653-c837, GHSA-w9gf-c5hh-cc8w and 1 more.