High [CVE-2026-14739] Heap overflow when preparsing SQL statements with excessive placeholders

DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders. The fix for CVE-2026-10879 did not allocate enough memory to handle approximately 1.2-million placeholders.

DBI version 1.650 sets a hard limit of 99,999 placeholders. This vulnerability, a heap overflow, occurs when the software attempts to preparse SQL statements containing an extremely large number of placeholders.

This could allow a remote attacker to cause a denial of service or potentially execute arbitrary code. A heap overflow can occur when processing SQL statements with an exceptionally large number of placeholders, potentially leading to a denial of service or arbitrary code execution.

While requiring an extreme number of placeholders, this flaw could impact applications utilizing DBI in Red Hat environments that handle untrusted or maliciously crafted SQL queries. Red Hat severity: Important — CVSS 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

Weakness: CWE-131. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Insights proxy 1.5; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7.

Red Hat fixing advisory: RHSA-2026:49514, RHSA-2026:52772, RHSA-2026:62667, RHSA-2026:49612, RHSA-2026:53371.

Affected products named by the advisory: Red Hat package: perl-dbi.