REDHAT-BUG-2497916: High severity Perl DBI vulnerability
DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders.
The fix for CVE-2026-10879 did not allocate enough memory to handle approximately 1.2-million placeholders.
DBI version 1.650 sets a hard limit of 99,999 placeholders.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
DBI (Perl)to a version that resolves this vulnerability.Fixed in 1.650Patch CVE-2026-10879 - Compensating control
Set/ensure an application-level limit on the number of SQL placeholders so queries with extremely high placeholder counts (e.g., around 1.2-million placeholders) are not prepared/executed, since DBI v<1.650 can heap overflow and the earlier CVE-2026-10879 memory fix did not handle ~1.2-million placeholders.
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2497916?
The severity of REDHAT-BUG-2497916 is high with a CVSS score of 7.
How do I fix REDHAT-BUG-2497916?
To fix REDHAT-BUG-2497916, upgrade to Perl DBI version 1.650 or later.
What does REDHAT-BUG-2497916 affect?
REDHAT-BUG-2497916 affects versions of Perl DBI prior to 1.650.
What vulnerability does REDHAT-BUG-2497916 address?
REDHAT-BUG-2497916 addresses a heap overflow vulnerability in DBI when handling an extreme number of SQL placeholders.
What is the main issue caused by REDHAT-BUG-2497916?
The main issue caused by REDHAT-BUG-2497916 is the potential heap overflow when preparsing SQL statements with approximately 1.2-million placeholders.