An update for perl-DBI is now available for openEuler-22.03-LTS-SP4,openEuler-24.03-LTS-SP1,openEuler-24.03-LTS-SP3,openEuler-24.03-LTS-SP4,openEuler-20.03-LTS-SP4
Security Advisory
openeuler-security@openeuler.org
openEuler security committee
openEuler-SA-2026-3183
Final
1.0
1.0
2026-07-24
Initial
2026-07-24
2026-07-24
openEuler SA Tool V1.0
2026-07-24
perl-DBI security update
An update for perl-DBI is now available for openEuler-22.03-LTS-SP4,openEuler-24.03-LTS-SP1,openEuler-24.03-LTS-SP3,openEuler-24.03-LTS-SP4,openEuler-20.03-LTS-SP4
The DBI is the standard database interface module for Perl. It defines a set of methods, variables and conventions that provide a consistent database interface independent of the actual database being used. It is important to remember that the DBI is just an interface. The DBI is a layer of "glue" between an application and one or more database driver modules. It is the driver modules which do most of the real work. The DBI provides a standard interface and framework for the drivers to operate within.
Security Fix(es):
DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders.
The fix for CVE-2026-10879 did not allocate enough memory to handle approximately 1.2-million placeholders.
DBI version 1.650 sets a hard limit of 99,999 placeholders.(CVE-2026-14739)
DBI::SQL::Nano versions from 1.42 before 1.651 for Perl have inverted <= and >= SQL operators on text.
DBI::SQL::Nano, DBI's built-in mini-SQL engine, evaluated WHERE predicates incorrectly in some cases. In the non-numeric string branch of the is_matched method, <= was evaluated using Perl's ge operator, and >= was evaluated using Perl's le operator.
SQL::Nano is the fallback query engine for DBI's file-backed drivers (DBD::File, DBD::DBM, CSV-style drivers) whenever SQL::Statement is not installed, and is forced whenever DBI_SQL_NANO=1. Queries over such tables use these predicates directly.
The impact depends on the context. Where an application relies on a WHERE clause to filter file-backed data for policy or authorization, an inverted <=/>= comparison silently returns the wrong rows.(CVE-2026-15043)
DBI::ProfileData versions before 1.651 for Perl do not limit the path index.
The path index column of profile dump files is used to allocate an array of data for the parser. An unbounded value allows an attacker to specify a large index and consume available memory.(CVE-2026-60081)
DBI versions before 1.651 for Perl do not enforce statement handle consistency with the row.
When the statement handle had no fields but the source row was non-empty, the internal row-buffer helper would read from a negative array index.
This could be triggered by a caller supplying inconsistent metadata and rows to the prepare method.(CVE-2026-60082)
An update for perl-DBI is now available for openEuler-22.03-LTS-SP4,openEuler-24.03-LTS-SP1,openEuler-24.03-LTS-SP3,openEuler-24.03-LTS-SP4,openEuler-20.03-LTS-SP4.
openEuler Security has rated this update as having a security impact of critical. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section.
Critical
perl-DBI
https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3183
https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-14739
https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-15043
https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-60081
https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-60082
https://nvd.nist.gov/vuln/detail/CVE-2026-14739
https://nvd.nist.gov/vuln/detail/CVE-2026-15043
https://nvd.nist.gov/vuln/detail/CVE-2026-60081
https://nvd.nist.gov/vuln/detail/CVE-2026-60082
openEuler-22.03-LTS-SP4
openEuler-24.03-LTS-SP1
openEuler-24.03-LTS-SP3
openEuler-24.03-LTS-SP4
openEuler-20.03-LTS-SP4
perl-DBI-1.643-6.oe2203sp4.aarch64.rpm
perl-DBI-debuginfo-1.643-6.oe2203sp4.aarch64.rpm
perl-DBI-debugsource-1.643-6.oe2203sp4.aarch64.rpm
perl-DBI-1.643-6.oe2403sp1.aarch64.rpm
perl-DBI-debuginfo-1.643-6.oe2403sp1.aarch64.rpm
perl-DBI-debugsource-1.643-6.oe2403sp1.aarch64.rpm
perl-DBI-1.643-6.oe2403sp3.aarch64.rpm
perl-DBI-debuginfo-1.643-6.oe2403sp3.aarch64.rpm
perl-DBI-debugsource-1.643-6.oe2403sp3.aarch64.rpm
perl-DBI-1.648-2.oe2403sp4.aarch64.rpm
perl-DBI-debuginfo-1.648-2.oe2403sp4.aarch64.rpm
perl-DBI-debugsource-1.648-2.oe2403sp4.aarch64.rpm
perl-DBI-1.643-5.oe2003sp4.aarch64.rpm
perl-DBI-debuginfo-1.643-5.oe2003sp4.aarch64.rpm
perl-DBI-debugsource-1.643-5.oe2003sp4.aarch64.rpm
perl-DBI-1.643-6.oe2203sp4.src.rpm
perl-DBI-1.643-6.oe2403sp1.src.rpm
perl-DBI-1.643-6.oe2403sp3.src.rpm
perl-DBI-1.648-2.oe2403sp4.src.rpm
perl-DBI-1.643-5.oe2003sp4.src.rpm
perl-DBI-1.643-6.oe2203sp4.x86_64.rpm
perl-DBI-debuginfo-1.643-6.oe2203sp4.x86_64.rpm
perl-DBI-debugsource-1.643-6.oe2203sp4.x86_64.rpm
perl-DBI-1.643-6.oe2403sp1.x86_64.rpm
perl-DBI-debuginfo-1.643-6.oe2403sp1.x86_64.rpm
perl-DBI-debugsource-1.643-6.oe2403sp1.x86_64.rpm
perl-DBI-1.643-6.oe2403sp3.x86_64.rpm
perl-DBI-debuginfo-1.643-6.oe2403sp3.x86_64.rpm
perl-DBI-debugsource-1.643-6.oe2403sp3.x86_64.rpm
perl-DBI-1.648-2.oe2403sp4.x86_64.rpm
perl-DBI-debuginfo-1.648-2.oe2403sp4.x86_64.rpm
perl-DBI-debugsource-1.648-2.oe2403sp4.x86_64.rpm
perl-DBI-1.643-5.oe2003sp4.x86_64.rpm
perl-DBI-debuginfo-1.643-5.oe2003sp4.x86_64.rpm
perl-DBI-debugsource-1.643-5.oe2003sp4.x86_64.rpm
perl-DBI-help-1.643-6.oe2203sp4.noarch.rpm
perl-DBI-help-1.643-6.oe2403sp1.noarch.rpm
perl-DBI-help-1.643-6.oe2403sp3.noarch.rpm
perl-DBI-help-1.648-2.oe2403sp4.noarch.rpm
perl-DBI-help-1.643-5.oe2003sp4.noarch.rpm
DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders.
The fix for CVE-2026-10879 did not allocate enough memory to handle approximately 1.2-million placeholders.
DBI version 1.650 sets a hard limit of 99,999 placeholders.
2026-07-24
CVE-2026-14739
openEuler-22.03-LTS-SP4
openEuler-24.03-LTS-SP1
openEuler-24.03-LTS-SP3
openEuler-24.03-LTS-SP4
openEuler-20.03-LTS-SP4
Critical
9.8
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
perl-DBI security update
2026-07-24
https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3183
DBI::SQL::Nano versions from 1.42 before 1.651 for Perl have inverted <= and >= SQL operators on text.
DBI::SQL::Nano, DBI's built-in mini-SQL engine, evaluated WHERE predicates incorrectly in some cases. In the non-numeric string branch of the is_matched method, <= was evaluated using Perl's ge operator, and >= was evaluated using Perl's le operator.
SQL::Nano is the fallback query engine for DBI's file-backed drivers (DBD::File, DBD::DBM, CSV-style drivers) whenever SQL::Statement is not installed, and is forced whenever DBI_SQL_NANO=1. Queries over such tables use these predicates directly.
The impact depends on the context. Where an application relies on a WHERE clause to filter file-backed data for policy or authorization, an inverted <=/>= comparison silently returns the wrong rows.
2026-07-24
CVE-2026-15043
openEuler-22.03-LTS-SP4
openEuler-24.03-LTS-SP1
openEuler-24.03-LTS-SP3
openEuler-24.03-LTS-SP4
openEuler-20.03-LTS-SP4
Critical
9.8
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
perl-DBI security update
2026-07-24
https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3183
DBI::ProfileData versions before 1.651 for Perl do not limit the path index.
The path index column of profile dump files is used to allocate an array of data for the parser. An unbounded value allows an attacker to specify a large index and consume available memory.
2026-07-24
CVE-2026-60081
openEuler-22.03-LTS-SP4
openEuler-24.03-LTS-SP1
openEuler-24.03-LTS-SP3
openEuler-24.03-LTS-SP4
openEuler-20.03-LTS-SP4
High
7.5
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
perl-DBI security update
2026-07-24
https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3183
DBI versions before 1.651 for Perl do not enforce statement handle consistency with the row.
When the statement handle had no fields but the source row was non-empty, the internal row-buffer helper would read from a negative array index.
This could be triggered by a caller supplying inconsistent metadata and rows to the prepare method.
2026-07-24
CVE-2026-60082
openEuler-22.03-LTS-SP4
openEuler-24.03-LTS-SP1
openEuler-24.03-LTS-SP3
openEuler-24.03-LTS-SP4
openEuler-20.03-LTS-SP4
Critical
9.1
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
perl-DBI security update
2026-07-24
https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3183