https://bugzilla.redhat.com/show_bug.cgi?id=2542965
Bug ID: 2542965
Summary: CVE-2026-88815 perl-DBI: perl-DBI: Denial of Service
via invalid memory read during numeric type casting
[fedora-all]
Product: Fedora
Version: rawhide
Status: NEW
Whiteboard: {"flaws": ["6c6274dc-3669-4090-913d-a6ba1c140670"]}
Component: perl-DBI
Keywords: Security, SecurityTracking
Severity: high
Priority: high
Assignee: [email protected]
Reporter: [email protected]
QA Contact: [email protected]
CC: [email protected], [email protected],
[email protected],
[email protected], [email protected]
Blocks: 2542559 (CVE-2026-88815)
Target Milestone: ---
Classification: Fedora
Disclaimer: Community trackers are created by Red Hat Product Security team on
a best effort basis. Package maintainers are required to ascertain if the flaw
indeed affects their package, before starting the update process.
DBI versions before 1.654 for Perl incorrectly treat numeric values as strings
in sql_type_cast_svpv.
When casting to SQL_NUMERIC, sql_type_cast_svpv passes the string pointer and
length of the SV to grok_number without stringifying it first. An integer (IV)
or floating-point (NV) value has no valid string pointer, so grok_number reads
from an invalid address, triggering a segmentation fault.
This is reachable in Perl using the sql_type_cast function:
my $num = 42;
DBI::sql_type_cast( $num, DBI::SQL_NUMERIC, 0 );
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=2542559
[Bug 2542559] CVE-2026-88815 perl-DBI: perl-DBI: Denial of Service via invalid
memory read during numeric type casting
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2542965
Report this comment as SPAM:
https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-spam&short_desc=Report%20of%20Bug%202542965%23c0
--
_______________________________________________
perl-devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedoraproject.org/archives/list/[email protected]
Do not reply to spam, report it:
https://forge.fedoraproject.org/infra/tickets/issues/new
