HMBRAND DBI::SQL::Nano up to 1.650 SQL Evaluation Engine is_matched comparison

Summaryinfo

A vulnerability has been found in HMBRAND DBI::SQL::Nano up to 1.650 and classified as problematic. This issue affects the function is_matched of the component SQL Evaluation Engine. This manipulation causes comparison. This vulnerability appears as CVE-2026-15043. The attack requires local access. There is no available exploit.

Detailsinfo

A vulnerability has been found in HMBRAND DBI::SQL::Nano up to 1.650 and classified as problematic. Affected by this vulnerability is the function is_matched of the component SQL Evaluation Engine. The manipulation with an unknown input leads to a comparison vulnerability. The CWE definition for the vulnerability is CWE-697. The product compares two entities in a security-relevant context, but the comparison is incorrect, which may lead to resultant weaknesses. As an impact it is known to affect confidentiality. The summary by CVE is:

DBI::SQL::Nano versions from 1.42 before 1.651 for Perl have inverted <= and >= SQL operators on text. DBI::SQL::Nano, DBI's built-in mini-SQL engine, evaluated WHERE predicates incorrectly in some cases. In the non-numeric string branch of the is_matched method, <= was evaluated using Perl's ge operator, and >= was evaluated using Perl's le operator. SQL::Nano is the fallback query engine for DBI's file-backed drivers (DBD::File, DBD::DBM, CSV-style drivers) whenever SQL::Statement is not installed, and is forced whenever DBI_SQL_NANO=1. Queries over such tables use these predicates directly. The impact depends on the context. Where an application relies on a WHERE clause to filter file-backed data for policy or authorization, an inverted <=/>= comparison silently returns the wrong rows.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-15043 since 07/08/2026. The exploitation appears to be easy. Attacking locally is a requirement. Technical details of the vulnerability are known, but there is no available exploit.

The vulnerability scanner Nessus provides a plugin with the ID 326906 (Linux Distros Unpatched Vulnerability : CVE-2026-15043), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 1.651 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (326906) and EUVD (EUVD-2026-43654). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• HMBRAND

Name

• DBI::SQL::Nano

Version

• 1.650

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion