CVE-2026-88816: DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in FetchHashKeyName

Perl DBI before 1.654 incorrectly treats a numeric FetchHashKeyName attribute as a string. fetchrow_hashref uses that attribute's raw string pointer as the hash key name without stringifying it first, so an integer or floating-point value leaves an invalid pointer and the process crashes with a segmentation fault. The result is denial of service for the Perl process, not described as code execution, and only when the attribute is set to a non-string rather than a normal column-name mode. The flaw is in the widely deployed DBI database interface for Perl, in every version before 1.654. No public proof of concept is known and it is not listed in CISA KEV.

Do: Upgrade Perl DBI to version 1.654 or later and restart long-running Perl processes so they load the fixed module. Until then, set FetchHashKeyName only to a string (such as NAME, NAME_lc, or NAME_uc) and never to an integer or floating-point value, especially if that value can come from outside the application.