Two critical vulnerabilities (CVE-2026-9698 and CVE-2026-10879, both CVSS 9.8) in the Perl DBI module can lead to denial of service or arbitrary code execution via improper error message handling and memory mishandling in SQL statements with more than nine binders. All versions prior to 1.648 are affected, and users must upgrade to Perl DBI version 1.648 to mitigate these issues.
It was discovered that the Perl DBI module incorrectly handled certain error messages. An attacker could use this issue to cause applications using the Perl DBI module to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2026-9698) It was discovered that the Perl DBI module incorrectly handled memory when preparsing SQL statements that included more than nine binders. An attacker could use this issue to cause applications using the Perl DBI module to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2026-10879)