CVE-2026-60082: DBI for Perl Buffer Overflow Vulnerability

CVE-2026-60082 Overview

CVE-2026-60082 is an out-of-bounds read vulnerability in the Perl Database Interface (DBI) module in versions before 1.651. The flaw resides in the internal _set_fbav row-buffer helper inside DBI.xs. When a statement handle has zero fields but a caller supplies a non-empty source row through the prepare method, the helper reads from a negative array index. The vulnerability is classified as [CWE-125] Out-of-Bounds Read and can be triggered remotely without authentication when Perl applications pass inconsistent metadata to DBI.

Critical Impact
Attackers who can influence statement handle metadata or row data can trigger process memory disclosure and denial of service in any Perl application built on DBI.

Affected Products

Perl DBI module versions prior to 1.651
Applications and services embedding DBI for database access
Downstream Perl distributions bundling vulnerable DBI releases

Discovery Timeline

2026-07-14 - CVE-2026-60082 published to NVD
2026-07-14 - Advisory GHSA-rwhc-hhmv-cjvg published on GitHub
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-60082

Vulnerability Analysis

The defect lives in the _set_fbav function inside DBI.xs, the XS glue that backs DBI's field-buffer array operations. The function compares src_fields (derived from the source row via AvFILL(src_av)+1) against dst_fields (the statement handle row buffer size). When dst_fields equals zero but src_fields is non-zero, the mismatch branch executed without validating the destination buffer size. Downstream logic then indexed the destination array using a negative offset, producing an out-of-bounds read against Perl interpreter memory.

This condition arises when callers supply inconsistent metadata to prepare, notably a statement handle that has not been configured with any output fields. The read can leak adjacent SV structures or crash the interpreter, depending on memory layout.

Root Cause

DBI did not enforce consistency between the statement handle's declared field count and the row data being written. The XS code assumed dst_fields was always positive, so no lower-bound check guarded the array access path taken when the two sizes diverged.

Attack Vector

Exploitation requires a caller to hand DBI a mismatched row and statement handle. This can occur through untrusted input flowing into database result construction, custom database drivers (DBDs), or higher-level frameworks that build synthetic result sets. The attack is network-reachable in any web service that funnels attacker-controlled data into affected DBI code paths.

text

     src_av = (AV*)SvRV(src_rv);
     src_fields = AvFILL(src_av)+1;
     if (src_fields != dst_fields) {
+        if ( dst_fields == 0 )
+            croak("_set_fbav(%s): array has %d elements, but the statement handle row buffer has 0",
+                    neatsvpv(src_rv,0), src_fields);
         warn("_set_fbav(%s): array has %d elements, the statement handle row buffer has %d (and NUM_OF_FIELDS is %d)",
                 neatsvpv(src_rv,0), src_fields, dst_fields, DBIc_NUM_FIELDS(imp_sth));
         SvREADONLY_off(dst_av);

Source: GitHub Commit Patch. The patch adds an explicit croak when dst_fields == 0, aborting the operation before the negative-index read occurs.

Detection Methods for CVE-2026-60082

Indicators of Compromise

Perl process crashes or segmentation faults originating in DBI.xs or _set_fbav stack frames
Unexpected warn output referencing _set_fbav with mismatched element counts and a row buffer of 0
Anomalous memory content in error logs or HTTP responses from Perl-based database services

Detection Strategies

Inventory installed DBI versions across all Perl runtimes using perl -MDBI -e 'print $DBI::VERSION' and flag anything below 1.651
Audit application code paths that call prepare with dynamically built column metadata or synthetic result rows
Enable core-dump capture on Perl workers and inspect crash traces for _set_fbav frames

Monitoring Recommendations

Ship Perl STDERR warnings to a centralized log pipeline and alert on _set_fbav messages
Monitor CPAN and OS package feeds for DBI updates and correlate deployed versions against 1.651
Track HTTP 5xx spikes on Perl services that use DBI as a leading indicator of triggered crashes

How to Mitigate CVE-2026-60082

Immediate Actions Required

Upgrade DBI to version 1.651 or later on every system that ships a Perl interpreter
Restart long-running Perl processes such as mod_perl, Starman, and plack workers after upgrading
Review custom DBD drivers for any code path that calls _set_fbav with unchecked row data

Patch Information

The fix is included in DBI 1.651, released via CPAN. See the MetaCPAN Release Changes and the upstream GitHub Security Advisory for full details. The OpenWall OSS-Security Mailing List post provides distribution coordination context.

Workarounds

Validate that any code invoking prepare sets an accurate NUM_OF_FIELDS before writing rows into the field-buffer array
Reject or sanitize untrusted inputs that influence statement handle metadata prior to reaching DBI
Isolate Perl services behind process supervisors that automatically restart on crash to limit denial-of-service duration

bash

# Upgrade DBI from CPAN
cpanm DBI@1.651

# Verify installed version
perl -MDBI -e 'print "DBI version: $DBI::VERSION\n"'