Loading story…
A heap overflow vulnerability tracked as CVE-2026-14739 was disclosed in DBI for Perl versions before 1.650. The flaw occurs during SQL statement preparsing when an attacker supplies an extreme number of placeholders, leading to an out-of-bounds write classified as CWE-787. The issue stems from an incomplete fix for CVE-2026-10879, which still failed to allocate enough memory when handling roughly 1.2 million placeholders.
The maintainers addressed the bug in DBI 1.650 by enforcing a hard limit of 99,999 placeholders, preventing the oversized input condition that triggered the heap overflow. Organizations using Perl applications that rely on DBI should identify deployments running versions earlier than 1.650 and prioritize upgrades to remove exposure to malformed SQL statements that could crash processes or potentially enable further exploitation.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
CVE-2026-14739 was published for a heap overflow vulnerability affecting DBI for Perl versions before 1.650. The flaw is classified as CWE-787 out-of-bounds write and is triggered during SQL statement preparsing with roughly 1.2 million placeholders.
DBI version 1.650 addressed a heap overflow in SQL statement preparsing that could be triggered by an extreme number of placeholders. The fix added a hard limit of 99,999 placeholders and corrected an insufficient prior fix for CVE-2026-10879.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Perl `DBI` project released a series of updates that fixed multiple security flaws across `DBI` and related components including `DBI::SQL::Nano`, `DBD::File`, and `DBI::ProfileData`. The changelog for versions `1.648`, `1.650`, and `1.651` lists fixes for `CVE-2026-9698`, `CVE-2026-10879`, `CVE-2026-14380`, `CVE-2026-14739`, `CVE-2026-14740`, `CVE-2026-15043`, `CVE-2026-15392`, `CVE-2026-60081`, and `CVE-2026-60082`, reflecting a broad hardening effort across the database interface stack. The patched issues include code injection, out-of-bounds reads, buffer and stack overflows, path traversal or symlink problems, and limits around placeholder parsing. One of the referenced weakness classes is **CWE-134**, `Use of Externally-Controlled Format String`, underscoring the memory-safety and input-handling risks addressed in the releases. Organizations using Perl applications that depend on `DBI` or its file- and SQL-related modules should prioritize upgrading to the latest fixed versions and review exposed components for unsafe input handling and file access patterns.
Jul 14, 2026
The CPAN Security Group disclosed two memory-safety vulnerabilities affecting widely used Perl modules. **CVE-2026-7040** impacts `Text::Minify::XS` from `v0.3.0` before `v0.7.8`, where malformed UTF-8 input can trigger a heap overflow in the `minify` and `minify_utf8` functions, leading to heap corruption through improper Unicode handling. Maintainers advised users to upgrade to `v0.7.8` or later, and said deployments that cannot patch immediately should validate strings before passing them to the affected routines. A separate advisory, **CVE-2026-7111**, affects `Text::CSV_XS` before `1.62` and stems from a use-after-free when registered callbacks extend the Perl argument stack. The bug arises because methods including `Parse`, `print`, `getline`, and `getline_all` may retain a stale stack pointer across callback execution, creating a path to type confusion, memory corruption, crashes, or logic errors. The issue does not affect `Text::CSV_XS` instances that do not use registered callbacks, and the fix was released in version `1.62` after a public patch and CPAN publication.
Jun 29, 2026
An oss-sec advisory highlighted **CVE-2017-20230** in Perl's `Storable` module, where versions before **3.05** contain a stack-based buffer overflow in `retrieve_hook`. The flaw occurs because a class-name length is stored in a signed integer and later handled as unsigned during read operations, allowing crafted serialized data to trigger the overflow. The issue was patched shortly after disclosure and fixed in **Storable 3.05**, with later inclusion in Perl through newer bundled releases. Follow-up discussion on oss-sec questioned the practical security impact and even the usefulness of the CVE because `Storable` documentation already warns that it is **unsafe for untrusted input**. Participants pointed to earlier deserialization concerns, including **CVE-2015-1592**, and debated whether malformed local `Storable` files should continue to receive CVE treatment given the module's longstanding security warning and lack of a safe mode for hostile data.
Jun 29, 2026