Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2026-88816

DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in FetchHashKeyName

Description

DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in FetchHashKeyName. fetchrow_hashref uses the string pointer of the FetchHashKeyName attribute as the key name without stringifying it first. When FetchHashKeyName has been set to an integer (IV) or floating-point (NV) value, that pointer is invalid, so reading the key name triggers a segmentation fault. This can be triggered with the following code: my $dbh = DBI->connect( "dbi:ExampleP:", "", "", { RaiseError => 0, PrintError => 0 } ); $dbh->{FetchHashKeyName} = 42; my $sth = $dbh->prepare("select mode, size, name from ."); $sth->execute; $sth->fetchrow_hashref;

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

DBI

Default version status: unaffected

  • 0 to < 1.654affected
pkg:cpan/DBI

References