perl5-dbi DBI up to 1.653 fetchrow_hashref FetchHashKeyName memory corruption

Summaryinfo

A vulnerability was found in perl5-dbi DBI up to 1.653. It has been rated as problematic. Affected by this vulnerability is the function fetchrow_hashref. This manipulation of the argument FetchHashKeyName causes memory corruption. This vulnerability appears as CVE-2026-88816. The attack may be initiated remotely. There is no available exploit. Upgrading the affected component is advised.

Detailsinfo

A vulnerability classified as problematic was found in perl5-dbi DBI up to 1.653. Affected by this vulnerability is the function fetchrow_hashref. The manipulation of the argument FetchHashKeyName with an unknown input leads to a memory corruption vulnerability. The CWE definition for the vulnerability is CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. As an impact it is known to affect availability. The summary by CVE is:

DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in FetchHashKeyName. fetchrow_hashref uses the string pointer of the FetchHashKeyName attribute as the key name without stringifying it first. When FetchHashKeyName has been set to an integer (IV) or floating-point (NV) value, that pointer is invalid, so reading the key name triggers a segmentation fault. This can be triggered with the following code: my $dbh = DBI->connect( "dbi:ExampleP:", "", "", { RaiseError => 0, PrintError => 0 } ); $dbh->{FetchHashKeyName} = 42; my $sth = $dbh->prepare("select mode, size, name from ."); $sth->execute; $sth->fetchrow_hashref;

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-88816 since 09/10/2026. The exploitation appears to be easy. The attack can be launched remotely. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 1.654 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Programming Language Software

Vendor

• perl5-dbi

Name

• DBI

Version

• 1.653

Website

• Product: https://github.com/perl5-dbi/dbi/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion