DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in sql_type_cast_svpv
DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in sql_type_cast_svpv. When casting to SQL_NUMERIC, sql_type_cast_svpv passes the string pointer and length of the SV to grok_number without stringifying it first. An integer (IV) or floating-point (NV) value has no valid string pointer, so grok_number reads from an invalid address, triggering a segmentation fault. This is reachable in Perl using the sql_type_cast function: my $num = 42; DBI::sql_type_cast( $num, DBI::SQL_NUMERIC, 0 );
CVE-2026-88815
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-88815
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://github.com/perl5-dbi/dbi",
"modules": [
"DBI"
],
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "1.654",
"versionType": "custom"
}
],
"packageURL": "pkg:cpan/DBI",
"packageName": "DBI",
"programFiles": [
"DBI.xs"
],
"collectionURL": "https://cpan.org/modules",
"defaultStatus": "unaffected",
"programRoutines": [
{
"name": "DBI::sql_type_cast"
},
{
"name": "sql_type_cast_svpv"
}
]
}
]- Related CVEs
- CVE-2026-88815
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #4870 · Revision 1
- Added to Heist Feed
- Publisher date