Type-confusion crash in Perl DBI before 1.654
Perl DBI before 1.654 has a type-confusion flaw (CWE-843) in sql_type_cast_svpv. When a value is cast to SQL_NUMERIC, the function hands the scalar’s string pointer and length to grok_number without stringifying it first, so an integer or floating-point value—which has no valid string buffer—is read from an invalid address and the process segmentation-faults. That path is reachable through DBI::sql_type_cast, and untrusted input that drives a numeric value into this cast can crash the Perl process (denial of service); the report does not describe code execution or data theft. Anyone running DBI before 1.654 in an application that reaches this cast, directly or through a DBD driver, is affected. There is no known public proof-of-concept, the issue is not on the CISA KEV list, and CVSS has not yet been scored.
What to do: Upgrade Perl DBI to 1.654 or later via the operating-system package or CPAN, then restart every process that loaded the older module. Until that is done, do not pass bare integers or floating-point values into DBI::sql_type_cast for SQL_NUMERIC; stringify those values first, and inventory applications and DBD drivers that depend on DBI for any copy still older than 1.654.
| Perl DBI project DBI | before 1.654 |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in sql_type_cast_svpv. When casting to SQL_NUMERIC, sql_type_cast_svpv passes the string pointer and length of the SV to grok_number without stringifying it first. An integer (IV) or floating-point (NV) value has no valid string pointer, so grok_number reads from an invalid address, triggering a segmentation fault. This is reachable in Perl using the sql_type_cast function: my $num = 42; DBI::sql_type_cast( $num, DBI::SQL_NUMERIC, 0 );
Perl DBI before 1.654 treats numeric values as strings in sql_type_cast_svpv.
Robert Rothenberg disclosed CVE-2026-88815 in Perl DBI versions before 1.654. The sql_type_cast_svpv function incorrectly treats numeric values as strings. The oss-security post points to the DBI distribution on MetaCPAN and the perl5-dbi GitHub repository. No exploitation in the wild is mentioned.