Type-confusion crash in Perl DBI before 1.654
Perl DBI before 1.654 incorrectly treats a numeric FetchHashKeyName attribute as a string. fetchrow_hashref uses that attribute's raw string pointer as the hash key name without stringifying it first, so an integer or floating-point value leaves an invalid pointer and the process crashes with a segmentation fault. The result is denial of service for the Perl process, not described as code execution, and only when the attribute is set to a non-string rather than a normal column-name mode. The flaw is in the widely deployed DBI database interface for Perl, in every version before 1.654. No public proof of concept is known and it is not listed in CISA KEV.
What to do: Upgrade Perl DBI to version 1.654 or later and restart long-running Perl processes so they load the fixed module. Until then, set FetchHashKeyName only to a string (such as NAME, NAME_lc, or NAME_uc) and never to an integer or floating-point value, especially if that value can come from outside the application.
| The DBI Project DBI | before 1.654 |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in FetchHashKeyName. fetchrow_hashref uses the string pointer of the FetchHashKeyName attribute as the key name without stringifying it first. When FetchHashKeyName has been set to an integer (IV) or floating-point (NV) value, that pointer is invalid, so reading the key name triggers a segmentation fault. This can be triggered with the following code: my $dbh = DBI->connect( "dbi:ExampleP:", "", "", { RaiseError => 0, PrintError => 0 } ); $dbh->{FetchHashKeyName} = 42; my $sth = $dbh->prepare("select mode, size, name from ."); $sth->execute; $sth->fetchrow_hashref;
Ubuntu's USN-8912-1 patches Perl DBI flaws that may allow code execution or denial of service.
Ubuntu Security Notice USN-8912-1 covers two Perl DBI flaws found by Harsh Raj Singhania. CVE-2026-78030 is insufficient validation of certain attributes that could let an attacker execute arbitrary code. CVE-2026-88816 is incorrect string handling that could cause a denial of service. The notice does not report active exploitation.
CVE-2026-88816: Perl DBI before 1.654 treats numeric FetchHashKeyName values as strings.
Robert Rothenberg posted CVE-2026-88816 to oss-security. Perl DBI versions before 1.654 incorrectly treat numeric values as strings in FetchHashKeyName. The report references the DBI distribution on MetaCPAN and the perl5-dbi GitHub repository. The available text does not say the flaw is being exploited.