Vulnerability - CVE-2026-14740

›

›vulnerability›CVE-2026-14740

Name

CVE-2026-14740

Source

NVD ( link)Debian ( link)

Description

DBI versions before 1.650 for Perl read one byte out-of-bounds in preparse when deleting an initial SQL comment. The preparse method normalises SQL and removes comments. When the SQL starts with a comment line, the deletion of that line during normalisation led to an out-of-bounds read by one byte. The result is a fault on memory-hardened builds and nondeterministic newline retention on normal builds.

CWEs

Published Date

Jul 7, 2026

Updated Date

Jul 10, 2026

Workaround

-

Advisories

https://github.com/perl5-dbi/dbi/commit/fc16f9e8b3dd5c65caf1867781ab2bfe2fadcc01.patchPatch

https://github.com/perl5-dbi/dbi/security/advisories/GHSA-35f4-f8m9-w8xgVendor Advisory

https://metacpan.org/release/HMBRAND/DBI-1.650/changesRelease Notes

http://www.openwall.com/lists/oss-security/2026/07/07/17Mailing List

Analysis#

Affected Component

Analysis

Vulnerability Ratings#

9.1

CVSSv31

NaN

other

Others affected components#

Name

Project

Project Version

Version

Status

yocto

kirkstone

1.643

Not Affected

yocto

master

1.651

Not Affected

Resolved with patches#

libdbi-perl (yocto:scarthgap)

#

Title

Author

Resolve

1

Fix out-of-bounds read in preparse when an initial comment is

Robert Rothenberg <perl@rhizomnic.com>

CVE-2026-14740