This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-14739 →

DEBIAN-CVE-2026-14739

DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders. The fix for CVE-2026-1...

Original description

The description as published by the source.

DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders. The fix for CVE-2026-10879 did not allocate enough memory to handle approximately 1.2-million placeholders. DBI version 1.650 sets a hard limit of 99,999 placeholders.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 libdbi-perl

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.643-4+deb12u2"}]}]

Debian:13 libdbi-perl

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.652-2~deb13u1"}]}]

Debian:14 libdbi-perl

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.650-1"}]}]

References

advisory security-tracker.debian.org