CVE-2026-14739

CRITICAL 9.8

DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders

CVSS Score

9.8

EPSS Score

0.2%

EPSS Percentile

8th

DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders. The fix for CVE-2026-10879 did not allocate enough memory to handle approximately 1.2-million placeholders. DBI version 1.650 sets a hard limit of 99,999 placeholders.

CWE	CWE-787
Vendor	hmbrand
Product	dbi
Published	Jul 7, 2026
Last Updated	Jul 8, 2026

Stay Ahead of the Next One

Get instant alerts for hmbrand dbi

Be the first to know when new critical vulnerabilities affecting hmbrand dbi are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

HMBRAND / DBI

0 < 1.650

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/perl5-dbi/dbi/commit/2b77c88b655e9539a592c71a61fb965fc0075395.patch cve.org: https://www.cve.org/CVERecord?id=CVE-2026-10879 metacpan.org: https://metacpan.org/release/HMBRAND/DBI-1.650/changes