CVE-2026-15043 DBI::SQL::Nano versions from 1.42 before 1.651 for Perl have inverted <= and >= SQL operators on text
Inverted SQL comparison operators in DBI::SQL::Nano allow attackers to bypass authorization filters or retrieve incorrect data from file-backed databases.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-15043?
CVE-2026-15043 is a critical vulnerability in HMBRAND DBI::SQL::Nano, published on 14 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
DBI::SQL::Nano versions from 1.42 before 1.651 for Perl have inverted <= and >= SQL operators on text.
DBI::SQL::Nano, DBI's built-in mini-SQL engine, evaluated WHERE predicates incorrectly in some cases. In the non-numeric string branch of the is_matched method, <= was evaluated using Perl's ge operator, and >= was evaluated using Perl's le operator.
SQL::Nano is the fallback query engine for DBI's file-backed drivers (DBD::File, DBD::DBM, CSV-style drivers) whenever SQL::Statement is not installed, and is forced whenever DBI_SQL_NANO=1. Queries over such tables use these predicates directly.
The impact depends on the context. Where an application relies on a WHERE clause to filter file-backed data for policy or authorization, an inverted <=/>= comparison silently returns the wrong rows.
Weakness: CWE-480
Which versions are affected by CVE-2026-15043?
How do I fix CVE-2026-15043?
Upgrade to a fixed version.
Is CVE-2026-15043 being exploited?
There is no known exploitation of CVE-2026-15043 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2026-15043, AZL-92418, BELL-CVE-2026-15043, DEBIAN-CVE-2026-15043, ECHO-8689-040b-7485, GHSA-mv45-ff6j-x9jp and 2 more.