https://bugzilla.redhat.com/show_bug.cgi?id=2542966
Bug ID: 2542966
Summary: CVE-2026-88816 perl-DBI: perl-DBI: Denial of Service
via numeric FetchHashKeyName attribute [fedora-all]
Product: Fedora
Version: rawhide
Status: NEW
Whiteboard: {"flaws": ["245b53b3-bf28-41f4-a33a-2cc84423bc98"]}
Component: perl-DBI
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: [email protected]
Reporter: [email protected]
QA Contact: [email protected]
CC: [email protected], [email protected],
[email protected],
[email protected], [email protected]
Blocks: 2542560 (CVE-2026-88816)
Target Milestone: ---
Classification: Fedora
Disclaimer: Community trackers are created by Red Hat Product Security team on
a best effort basis. Package maintainers are required to ascertain if the flaw
indeed affects their package, before starting the update process.
DBI versions before 1.654 for Perl incorrectly treat numeric values as strings
in FetchHashKeyName.
fetchrow_hashref uses the string pointer of the FetchHashKeyName attribute as
the key name without stringifying it first. When FetchHashKeyName has been set
to an integer (IV) or floating-point (NV) value, that pointer is invalid, so
reading the key name triggers a segmentation fault.
This can be triggered with the following code:
my $dbh = DBI->connect( "dbi:ExampleP:", "", "",
{ RaiseError => 0, PrintError => 0 } );
$dbh->{FetchHashKeyName} = 42;
my $sth = $dbh->prepare("select mode, size, name from .");
$sth->execute;
$sth->fetchrow_hashref;
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=2542560
[Bug 2542560] CVE-2026-88816 perl-DBI: perl-DBI: Denial of Service via numeric
FetchHashKeyName attribute
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2542966
Report this comment as SPAM:
https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-spam&short_desc=Report%20of%20Bug%202542966%23c0
--
_______________________________________________
perl-devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedoraproject.org/archives/list/[email protected]
Do not reply to spam, report it:
https://forge.fedoraproject.org/infra/tickets/issues/new
