CVE-2026-60082CWE-125

DBI versions before 1.651 for Perl do not enforce statement handle consistency with the row

Critical · published July 14, 2026

CVSS v3.1
9.1
EPSS
1%
Percentile
50.7
In the wild
Unconfirmed
What it is

DBI versions before 1.651 for Perl do not enforce statement handle consistency with the row.

When the statement handle had no fields but the source row was non-empty, the internal row-buffer helper would read from a negative array index.

This could be triggered by a caller supplying inconsistent metadata and rows to the prepare method.

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00653 · 50.7th percentile
Weakness
CWE-125 · Out-of-bounds Read
Published
2026-07-14T15:35Z
EPSS history
Timeline
  • 14 JUL 15:35Z
    DBI versions before 1.651 for Perl do not enforce statement handle consistency with the row
    cvelistv5