CVE-2026-88815GHSA-c8vq-w3wr-6979
DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in sql_type_cast_svpv
DBI
CVSS
6.2MediumExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 30 Sep 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.18%Chance of exploitation activity in the next 30 days, higher than 7% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in sql_type_cast_svpv.
When casting to SQL_NUMERIC, sql_type_cast_svpv passes the string pointer and length of the SV to grok_number without stringifying it first. An integer (IV) or floating-point (NV) value has no valid string pointer, so grok_number reads from an invalid address, triggering a segmentation fault.
This is reachable in Perl using the sql_type_cast function:
my $num = 42; DBI::sql_type_cast( $num, DBI::SQL_NUMERIC, 0 );
Text from GitHub Advisory Database
Affected versions 2
- Productaffected: all versions before 1.654CVE List
- DBI, perl<= 1.653GitHub