CVE-2026-88815: DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in sql_type_cast_svpv
DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in sqltypecastsvpv
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.655-1 - Upgrade
Upgrade
DBI for Perlto a version that resolves this vulnerability.Fixed in 1.654
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using a DBI version before 1.654 are exposed if they call DBI::sql_type_cast with SQL_NUMERIC and pass an integer or floating-point Perl value.
What does an attacker need to trigger the flaw?
The vulnerable code path requires a call to DBI::sql_type_cast targeting SQL_NUMERIC with a numeric IV or NV value. This causes an invalid memory read and can trigger a segmentation fault.
How can I determine whether my application is affected?
Check whether it uses DBI before version 1.654 and whether any code calls DBI::sql_type_cast with DBI::SQL_NUMERIC on numeric values, such as an unstringified integer or floating-point variable.
What should be done if an immediate upgrade is not possible?
Avoid passing integer or floating-point values directly to DBI::sql_type_cast when casting to SQL_NUMERIC. Convert the value to a string before making that call.