DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in FetchHashKeyName
DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in FetchHashKeyName. fetchrow_hashref uses the string pointer of the FetchHashKeyName attribute as the key name without stringifying it first. When FetchHashKeyName has been set to an integer (IV) or floating-point (NV) value, that pointer is invalid, so reading the key name triggers a segmentation fault. This can be triggered with the following code: my $dbh = DBI->connect( "dbi:ExampleP:", "", "", { RaiseError => 0, PrintError => 0 } ); $dbh->{FetchHashKeyName} = 42; my $sth = $dbh->prepare("select mode, size, name from ."); $sth->execute; $sth->fetchrow_hashref;
CVE-2026-88816
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-88816
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://github.com/perl5-dbi/dbi",
"modules": [
"DBI"
],
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "1.654",
"versionType": "custom"
}
],
"packageURL": "pkg:cpan/DBI",
"packageName": "DBI",
"programFiles": [
"DBI.xs"
],
"collectionURL": "https://cpan.org/modules",
"defaultStatus": "unaffected",
"programRoutines": [
{
"name": "DBD::_::st::fetchrow_hashref"
}
]
}
]- Related CVEs
- CVE-2026-88816
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #4871 · Revision 1
- Added to Heist Feed
- Publisher date