DBI up to 1.651 Output Buffer preparse heap-based overflow

Summaryinfo

A vulnerability marked as critical has been reported in DBI up to 1.651. This impacts the function preparse of the component Output Buffer. This manipulation causes heap-based overflow. This vulnerability is handled as CVE-2026-73193. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability was found in DBI up to 1.651. It has been declared as critical. Affected by this vulnerability is the function preparse of the component Output Buffer. The manipulation with an unknown input leads to a heap-based overflow vulnerability. The CWE definition for the vulnerability is CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

DBI versions before 1.652 for Perl allow a heap out-of-bounds write on 32-bit perl via an integer wraparound in the output buffer size computed by preparse. preparse reserves its output buffer with `newSV(strlen(statement) * 7 + 16)`, budgeting seven output bytes per input byte for the longest ':p99999' expansion. The product is computed in STRLEN, which is 32 bits wide on a 32-bit perl build, so a statement of 613,566,757 bytes multiplies to 4,294,967,299, wraps modulo 2^32 to 3, and reserves 19 bytes. The parser then copies the statement out through a raw pointer with no capacity check, writing the whole 585 MB input past the end of the allocation. The 99,999 placeholder limit does not bound this path, which is reached by ordinary non-placeholder content. Any caller that passes an untrusted statement of that length to preparse on a 32-bit perl gets a heap out-of-bounds write of attacker controlled bytes. Builds with a 64-bit STRLEN are not affected, since the wrap there needs a statement of about 2.3 exabytes.

This vulnerability is known as CVE-2026-73193 since 08/11/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details of the vulnerability are known, but there is no available exploit.

The vulnerability scanner Nessus provides a plugin with the ID 335834 (Linux Distros Unpatched Vulnerability : CVE-2026-73193), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 1.652 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (335834). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Name

• DBI

Version

• 1.651

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion