Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-07-07T22:05:45 DBI: DBI for Perl: Out-of-bounds read in SQL comment processing 5.0 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H CWE-125

DBI versions before 1.650 for Perl read one byte out-of-bounds in preparse when deleting an initial SQL comment. The preparse method normalises SQL and removes comments. When the SQL starts with a comment line, the deletion of that line during normalisation led to an out-of-bounds read by one byte. The result is a fault on memory-hardened builds and nondeterministic newline retention on normal builds.

A flaw was found in DBI for Perl. When processing SQL queries, the `preparse` method, which normalizes SQL and removes comments, can read one byte beyond its intended memory boundary. This occurs specifically when an SQL query begins with a comment line, leading to an out-of-bounds read during the comment deletion process. This issue may cause a program fault on systems with memory hardening or result in unpredictable newline retention in other environments.

Red Hat Enterprise Linux 10 Fix deferred perl-DBI Red Hat Enterprise Linux 6 Out of support scope perl-DBI Red Hat Enterprise Linux 7 Out of support scope perl-DBI Red Hat Enterprise Linux 8 Fix deferred perl-DBI Red Hat Enterprise Linux 8 Fix deferred perl-DBI:1.641/perl-DBI Red Hat Enterprise Linux 9 Fix deferred perl-DBI https://www.cve.org/CVERecord?id=CVE-2026-14740 https://nvd.nist.gov/vuln/detail/CVE-2026-14740 https://github.com/perl5-dbi/dbi/commit/fc16f9e8b3dd5c65caf1867781ab2bfe2fadcc01.patch https://github.com/perl5-dbi/dbi/security/advisories/GHSA-35f4-f8m9-w8xg https://metacpan.org/release/HMBRAND/DBI-1.650/changes