Critical severity · published Jul 14, 2026
CVE-2026-60082
DBI versions before 1.651 for Perl do not enforce statement handle consistency with the row
9.1
CVSS
0.7%
EPSS
No
On KEV
Description
DBI versions before 1.651 for Perl do not enforce statement handle consistency with the row.
When the statement handle had no fields but the source row was non-empty, the internal row-buffer helper would read from a negative array index.
This could be triggered by a caller supplying inconsistent metadata and rows to the prepare method.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 51% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DB
DBI · HMBRAND
before 1.651 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-60082
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-60082
github.com
https://github.com/perl5-dbi/dbi/commit/397868704291bbf0989b97e2c0661189890653e2.patch
github.com
https://github.com/perl5-dbi/dbi/security/advisories/GHSA-rwhc-hhmv-cjvg
metacpan.org
https://metacpan.org/release/HMBRAND/DBI-1.651/changes
www.openwall.com
http://www.openwall.com/lists/oss-security/2026/07/14/13
More from DBI
9.8
CVE-2026-14739
DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders
9.8
CVE-2026-9698
DBI versions before 1.648 for Perl saved errors in a limited-sized buffer
9.8
CVE-2026-10879
DBI versions before 1.648 for Perl have a heap overflow when preparsing SQL statements with more than 9 binders
9.1
CVE-2026-14740
DBI versions before 1.650 for Perl read one byte out-of-bounds in preparse when deleting an initial SQL comment