DEBIAN-CVE-2026-73193
DBI versions before 1.652 for Perl allow a heap out-of-bounds write on 32-bit perl via an integer wraparound in the output buffer size computed by preparse. preparse reserves its output buffer with `newSV(strlen(statement) * 7 + 16)`, budgeting seven output bytes per input byte for the longest ':p99999' expansion. The product is computed in STRLEN, which is 32 bits wide on a 32-bit perl build, so a statement of 613,566,757 bytes multiplies to 4,294,967,299, wraps modulo 2^32 to 3, and reserves 19 bytes. The parser then copies the statement out through a raw pointer with no capacity check, writing the whole 585 MB input past the end of the allocation. The 99,999 placeholder limit does not bound this path, which is reached by ordinary non-placeholder content. Any caller that passes an untrusted statement of that length to preparse on a 32-bit perl gets a heap out-of-bounds write of attacker controlled bytes. Builds with a 64-bit STRLEN are not affected, since the wrap there needs a statement of about 2.3 exabytes.
DEBIAN-CVE-2026-73193
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:DEBIAN-CVE-2026-73193
libdbi-perl
Source reference: /affected/0/package/name
- Affected versions
- 1.643-4
Source reference:
/affected/0/versions1.643-4+deb12u1Source reference:
/affected/0/versions - Fixed versions
- 1.643-4+deb12u2
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
libdbi-perl
Source reference: /affected/1/package/name
- Affected versions
- 1.647-1
Source reference:
/affected/1/versions1.647-1+deb13u1Source reference:
/affected/1/versions1.648-1Source reference:
/affected/1/versions1.649-1Source reference:
/affected/1/versions1.650-1Source reference:
/affected/1/versions1.651-1Source reference:
/affected/1/versions1.652-1Source reference:
/affected/1/versions - Fixed versions
- 1.652-2~deb13u1
Source reference:
/affected/1/ranges - Prerequisites
- Not stated in this record
libdbi-perl
Source reference: /affected/2/package/name
- Affected versions
- 1.647-1
Source reference:
/affected/2/versions1.648-1Source reference:
/affected/2/versions1.649-1Source reference:
/affected/2/versions1.650-1Source reference:
/affected/2/versions1.651-1Source reference:
/affected/2/versions - Fixed versions
- 1.652-1
Source reference:
/affected/2/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.643-4+deb12u2"
}
]
}
],
"package": {
"name": "libdbi-perl",
"purl": "pkg:deb/debian/libdbi-perl?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"versions": [
"1.643-4",
"1.643-4+deb12u1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-73193.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.652-2~deb13u1"
}
]
}
],
"package": {
"name": "libdbi-perl",
"purl": "pkg:deb/debian/libdbi-perl?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"versions": [
"1.647-1",
"1.647-1+deb13u1",
"1.648-1",
"1.649-1",
"1.650-1",
"1.651-1",
"1.652-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-73193.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.652-1"
}
]
}
],
"package": {
"name": "libdbi-perl",
"purl": "pkg:deb/debian/libdbi-perl?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"1.647-1",
"1.648-1",
"1.649-1",
"1.650-1",
"1.651-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-73193.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #56026 · Revision 1
- Added to Heist Feed
- Publisher date