"perl-DBI":"1.641" perl-DBI-1.641-11.module+el8+2066+81cc587d

The perl-DBI package provides the standard database interface module for the
Perl programming language. It implements a database-independent interface,
meaning it defines a consistent set of methods, variables, and conventions for
database operations.

Security Fix(es):

* perl-DBI: perl-DBI: Denial of Service via invalid memory read during numeric
type casting (CVE-2026-88815)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s)
listed in the References section.

CVE-2026-88815
DBI versions before 1.654 for Perl incorrectly treat numeric values as strings
in sql_type_cast_svpv. When casting to SQL_NUMERIC, sql_type_cast_svpv passes
the string pointer and length of the SV to grok_number without stringifying it
first. An integer (IV) or floating-point (NV) value has no valid string pointer,
so grok_number reads from an invalid address, triggering a segmentation fault.
This is reachable in Perl using the sql_type_cast function: my $num = 42;
DBI::sql_type_cast( $num, DBI::SQL_NUMERIC, 0 );

Modularity name: "perl-DBI"
Stream name: "1.641"