Medium [CVE-2026-15043] DBI::SQL::Nano: DBI::SQL::Nano: Incorrect SQL operator evaluation can lead to incorrect data filtering.

DBI::SQL::Nano versions from 1.42 before 1.651 for Perl have inverted = SQL operators on text. DBI::SQL::Nano, DBI's built-in mini-SQL engine, evaluated WHERE predicates incorrectly in some cases.

In the non-numeric string branch of the is_matched method, = was evaluated using Perl's le operator. SQL::Nano is the fallback query engine for DBI's file-backed drivers (DBD::File, DBD::DBM, CSV-style drivers) whenever SQL::Statement is not installed, and is forced whenever DBI_SQL_NANO=1.

Queries over such tables use these predicates directly. The impact depends on the context.

Where an application relies on a WHERE clause to filter file-backed data for policy or authorization, an inverted = comparison silently returns the wrong rows.

This vulnerability occurs because the engine incorrectly evaluates SQL operators for text comparisons, specifically inverting the logic for "less than or equal to" and "greater than or equal to" operations.

This can lead to applications that rely on these comparisons for filtering data, such as for policy or authorization, silently returning incorrect results. A Moderate impact flaw in perl-DBI's SQL::Nano engine can lead to incorrect data filtering.

This issue arises when applications use file-backed drivers with SQL::Nano as the fallback SQL engine, causing text comparison operators (` =`) to be inverted.