CVE-2026-15043: DBI::SQL::Nano Perl SQLi Vulnerability

CVE-2026-15043 Overview

CVE-2026-15043 affects DBI::SQL::Nano versions from 1.42 before 1.651 for Perl. The module's is_matched method inverts the <= and >= SQL operators when comparing non-numeric strings. In the affected branch, <= is evaluated using Perl's ge operator, and >= is evaluated using Perl's le operator. SQL::Nano acts as the fallback query engine for DBI's file-backed drivers such as DBD::File, DBD::DBM, and CSV-style drivers whenever SQL::Statement is not installed, and it is forced when DBI_SQL_NANO=1. Queries filtering file-backed data with string range predicates silently return the wrong rows.

Critical Impact
Applications relying on WHERE clauses to enforce policy or authorization over string columns can return unauthorized rows or omit intended rows, corrupting access decisions.

Affected Products

Perl DBI DBI::SQL::Nano versions 1.42 through 1.650
DBD::File, DBD::DBM, and CSV-style drivers falling back to SQL::Nano
Any Perl application running with DBI_SQL_NANO=1 environment variable set

Discovery Timeline

2026-07-14 - CVE CVE-2026-15043 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-15043

Vulnerability Analysis

The defect is a classic use of the wrong operator, classified as [CWE-480]. Within lib/DBI/SQL/Nano.pm, the is_matched routine dispatches SQL comparison operators to Perl equivalents. Numeric comparisons use <= and >= correctly, but the string branch swaps them, mapping SQL <= to Perl ge (greater-or-equal) and SQL >= to Perl le (less-or-equal). The result is that any range filter over string columns evaluates the inverse of the intended condition. Because the query still succeeds and returns a result set, callers receive incorrect data without any error indication.

Root Cause

The root cause is a transposition error in the operator dispatch table for string comparisons. The numeric path preserves ordering semantics, while the string path inverts them. Applications that combine string-typed columns with range predicates for authorization checks, audit filtering, or policy enforcement receive results that contradict the SQL semantics stated in the query.

Attack Vector

An attacker who can influence a WHERE clause value, or who queries a system whose access rules use string range comparisons, can access rows that should have been excluded. For example, a filter intended to restrict a user to records where owner <= 'user_boundary' will instead return records where owner >= 'user_boundary', exposing data outside the caller's scope. Exploitation does not require code execution or authentication bypass in the traditional sense — the query engine returns the wrong data by design of the bug.

text

         if ( $op eq '>' )  { return $val1 gt $val2; }
         if ( $op eq '=' )  { return $val1 eq $val2; }
         if ( $op eq '<>' ) { return $val1 ne $val2; }
-        if ( $op eq '<=' ) { return $val1 ge $val2; }
-        if ( $op eq '>=' ) { return $val1 le $val2; }
+        if ( $op eq '<=' ) { return $val1 le $val2; }
+        if ( $op eq '>=' ) { return $val1 ge $val2; }
     }
 }

Source: GitHub Patch Commit e9742ef

Detection Methods for CVE-2026-15043

Indicators of Compromise

Perl processes running with the environment variable DBI_SQL_NANO=1 set
Installed DBI distribution reporting $DBI::VERSION between 1.42 and 1.650 without SQL::Statement present
Application logs showing WHERE clauses with <= or >= operators against string columns in DBD::File, DBD::DBM, or CSV-backed tables

Detection Strategies

Inventory Perl installations and enumerate DBI module versions using perl -MDBI -e 'print $DBI::VERSION' across servers
Search codebases for DBI_SQL_NANO, DBD::File, DBD::DBM, and DBD::CSV usages combined with <= or >= SQL operators on text columns
Add regression tests that compare SQL::Nano result sets against expected sorted string ranges to detect the operator inversion

Monitoring Recommendations

Log and audit query result counts for authorization-critical file-backed queries and alert on statistically anomalous row counts
Track deployment of DBI package updates through configuration management and flag hosts still running vulnerable versions
Review application access logs for unexpected data access patterns that could indicate rows returned outside policy scope

How to Mitigate CVE-2026-15043

Immediate Actions Required

Upgrade the Perl DBI distribution to version 1.651 or later on all systems
Audit application code that queries file-backed DBI drivers with string range predicates and validate historical results
Unset the DBI_SQL_NANO=1 environment variable where SQL::Statement is available as a safer alternative engine

Patch Information

The fix ships in DBI 1.651. The patch in lib/DBI/SQL/Nano.pm swaps the Perl operators used for the string branch of is_matched, so SQL <= maps to Perl le and SQL >= maps to Perl ge. Details are available in the GitHub Security Advisory GHSA-mv45-ff6j-x9jp, the MetaCPAN Release Changes for DBI-1.651, and the OpenWall OSS-Security announcement.

Workarounds

Install SQL::Statement from CPAN so DBI's file-backed drivers use it in place of SQL::Nano
Rewrite affected queries to avoid <= and >= on string columns, substituting equivalent > / < combinations with adjusted boundary values
Perform authorization filtering in Perl code after retrieving rows, rather than relying on SQL::Nano predicates for policy enforcement

bash

# Upgrade DBI to the patched release via cpanm
cpanm DBI@1.651

# Verify the installed version
perl -MDBI -e 'print "DBI version: $DBI::VERSION\n"'

# Prefer SQL::Statement over SQL::Nano when available
cpanm SQL::Statement
unset DBI_SQL_NANO