CVE-2026-9698 DBI versions before 1.648 for Perl saved errors in a limited-sized buffer
Attackers can trigger a buffer overflow in the Perl DBI library by influencing error text, potentially leading to code execution or denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-9698?
CVE-2026-9698 is a high-severity memory corruption vulnerability in HMBRAND DBI, published on 9 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
DBI versions before 1.648 for Perl saved errors in a limited-sized buffer.
Error messages that were returned when RaiseError, PrintError or HandleError were set were written to a 200-byte buffer without a length limit.
Attackers that can influence the error text in an application can trigger a buffer overflow.
Which versions are affected by CVE-2026-9698?
It affects 1 product.
Linux distribution packages (13)
perl-DBI Rocky Linux:10 | All versions | 0:1.643-26.el10_2.1 |
perl-DBI Rocky Linux:8 | All versions | 0:1.641-5.module+el8.10.0+40245+1df7f06b |
perl-DBI Rocky Linux:9 | All versions | 0:1.643-9.el9_8.1 |
perl-DBI SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | All versions | 1.642-150200.3.12.1 |
perl-DBI SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | All versions | 1.642-150200.3.12.1 |
perl-DBI SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | All versions | 1.642-150200.3.12.1 |
perl-DBI SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | All versions | 1.642-150200.3.12.1 |
perl-DBI SUSE:Linux Enterprise Server 12 SP5-LTSS | All versions | 1.628-5.12.1 |
perl-DBI SUSE:Linux Enterprise Server 15 SP4-LTSS | All versions | 1.642-150200.3.12.1 |
perl-DBI SUSE:Linux Enterprise Server 15 SP5-LTSS | All versions | 1.642-150200.3.12.1 |
perl-DBI SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | All versions | 1.628-5.12.1 |
perl-DBI SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | All versions | 1.642-150200.3.12.1 |
perl-DBI SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | All versions | 1.642-150200.3.12.1 |
Products include Perl Dbi.
How do I fix CVE-2026-9698?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-9698 being exploited?
There is no known exploitation of CVE-2026-9698 in the wild and no public exploit code.
Other vulnerabilities in HMBRAND DBI
- CVE-2026-14739 Memory corruption in DBI
- CVE-2026-10879 DBI versions before 1.648 for Perl have a heap overflow when preparsing SQL statements with more than 9 binders
- CVE-2026-14740 DBI versions before 1.650 for Perl read one byte out-of-bounds in preparse when deleting an initial SQL comment
- CVE-2026-14380 DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile
- CVE-2014-10402 Path traversal in n/a
Sources
Also known as ALPINE-CVE-2026-9698, AZL-90132, BELL-CVE-2026-9698, CLSA-2026-1784808357, CLSA-2026-1784809563, DEBIAN-CVE-2026-9698 and 9 more.