| Name | CVE-2026-88816 |
| Description | DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in FetchHashKeyName. fetchrow_hashref uses the string pointer of the FetchHashKeyName attribute as the key name without stringifying it first. When FetchHashKeyName has been set to an integer (IV) or floating-point (NV) value, that pointer is invalid, so reading the key name triggers a segmentation fault. This can be triggered with the following code: my $dbh = DBI->connect( "dbi:ExampleP:", "", "", { RaiseError => 0, PrintError => 0 } ); $dbh->{FetchHashKeyName} = 42; my $sth = $dbh->prepare("select mode, size, name from ."); $sth->execute; $sth->fetchrow_hashref; |
| Source | CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| References | DLA-4798-1 |
| Debian Bugs | 1149042 |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| libdbi-perl (PTS) | bookworm | 1.643-4+deb12u1 | vulnerable |
| bookworm (security) | 1.643-4+deb12u3 | fixed | |
| trixie (security), trixie | 1.652-2~deb13u1 | vulnerable | |
| forky, sid | 1.655-1 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| libdbi-perl | source | bookworm | 1.643-4+deb12u3 | DLA-4798-1 | ||
| libdbi-perl | source | (unstable) | 1.654-1 | 1149042 |
[trixie] - libdbi-perl <no-dsa> (Minor issue)
https://lists.security.metacpan.org/cve-announce/msg/43915934/
Fixed by: https://github.com/perl5-dbi/dbi/commit/70962570212dc60a5428098cf2a0462ad5945851 (1.654)