CVE-2026-9698: DBI versions before 1.648 for Perl saved errors in a limited-sized buffer

Synopsis

A stack-based buffer overflow exists in the Perl DBI module (versions before 1.648). The vulnerability is reachable over the network without any authentication, and is triggered when an attacker can influence the error text that DBI writes into a fixed 200-byte buffer with no length check. Successful exploitation crashes the affected service, causing a denial of service. A patched-image rebuild at version 1.648 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the service over the network; the CVSS vector specifies AV:N, meaning no local or physical access is required.

• AuthenticationNot required

  No credentials or account of any kind are needed; the CVSS vector specifies PR:N, so the attack is open to unauthenticated parties.

• Victim interactionNot required

  No user action is needed to trigger the overflow; the CVSS vector specifies UI:N, so exploitation proceeds without any victim involvement.

• Attack complexityDetail

  Exploitation is reliable and condition-free; the CVSS vector specifies AC:L, meaning an attacker only needs to supply an oversized error string without depending on race conditions or specific memory layout.

Blast Radius

• Crashes the DBI-dependent Perl application process, taking the affected service offline.
• Repeated triggering of the overflow can sustain a denial-of-service condition for as long as the attacker can supply crafted error input.
• No confidentiality or integrity impact is indicated by the CVSS vector; stored data is not read or modified by this exploit.