"perl-DBI":"1.641" perl-DBI-1.641-10.module+el8+2048+c13f8946

The perl-DBI package provides the standard database interface module for the
Perl programming language. It implements a database-independent interface,
meaning it defines a consistent set of methods, variables, and conventions for
database operations.

Security Fix(es):

* perl-DBI: DBI for Perl: Heap out-of-bounds write via unvalidated numeric
placeholder (CVE-2026-73194)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s)
listed in the References section.

CVE-2026-73194
DBI versions before 1.652 for Perl allow a heap out-of-bounds write via an
unvalidated numeric placeholder that sets the binder counter in preparse.
preparse reserves seven output bytes per input byte, the width of the longest
':p99999' expansion. The ':N' branch parses the number with `atoi(src)` and
assigns it to the binder counter with no range check, so a statement containing
':2147483648' leaves the counter negative (-2147483648 with glibc, where atoi
wraps). Each following '?' then expands through `sprintf(start, ":p%d", idx++)`
to ':p-2147483648', 14 bytes with the terminating NUL where the buffer budgets
7. The placeholder limit added in 1.650 tests the counter against 99,999, which
a negative counter passes. Any caller that preparses an untrusted statement into
':pN' style placeholders gets a heap out-of-bounds write that grows with the
number of '?' marks following the poisoned placeholder. The '?' and '%s' return
styles compare the parsed number against the expected sequence and error out,
and are unaffected.

Modularity name: "perl-DBI"
Stream name: "1.641"