CVE-2026-60082 DBI versions before 1.651 for Perl do not enforce statement handle consistency with the row
A flaw in the Perl DBI library allows a denial of service via negative array index read when inconsistent metadata is supplied.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-60082?
CVE-2026-60082 is a critical vulnerability in HMBRAND DBI, published on 14 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
DBI versions before 1.651 for Perl do not enforce statement handle consistency with the row.
When the statement handle had no fields but the source row was non-empty, the internal row-buffer helper would read from a negative array index.
This could be triggered by a caller supplying inconsistent metadata and rows to the prepare method.
Weakness: CWE-125
Which versions are affected by CVE-2026-60082?
How do I fix CVE-2026-60082?
Upgrade to a fixed version.
Is CVE-2026-60082 being exploited?
There is no known exploitation of CVE-2026-60082 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2026-60082, AZL-92421, BELL-CVE-2026-60082, DEBIAN-CVE-2026-60082, ECHO-5b7b-64b3-88c0, GHSA-rwhc-hhmv-cjvg and 2 more.