Three Perl DBI and XS::Parse::Infix flaws disclosed

Rothenberg disclosed three Perl CVEs: two DBI issues before 1.654 and one in XS::Parse::Infix 0.40–0.49.

On 2026-09-28, Robert Rothenberg posted three related Perl vulnerability notices to oss-security. CVE-2026-88815 and CVE-2026-88816 both affect DBI versions before 1.654 and incorrectly treat numeric values as strings, in sql_type_cast_svpv and FetchHashKeyName respectively. Those notices point to the DBI distribution on MetaCPAN and the perl5-dbi GitHub repository. Separately, CVE-2026-85644 affects XS::Parse::Infix versions 0.40 through 0.49, which can treat a number as an array reference, and the notice points to the XS::Parse::Keyword distribution on MetaCPAN. The reports do not describe exploitation in the wild and do not name a fixed release for CVE-2026-85644. The sources do not disagree on the affected versions, functions, or disclosure details.

• CVE-2026-88815 affects Perl DBI versions before 1.654: sql_type_cast_svpv incorrectly treats numeric values as strings.
• CVE-2026-88816 affects Perl DBI versions before 1.654: FetchHashKeyName incorrectly treats numeric values as strings.
• CVE-2026-85644 affects XS::Parse::Infix versions 0.40 through 0.49: a number is treated as an array reference.
• Robert Rothenberg posted all three notices to oss-security on 2026-09-28.
• The DBI notices reference the DBI distribution on MetaCPAN and the perl5-dbi GitHub repository; the XS::Parse::Infix notice references the XS::Parse::Keyword distribution on MetaCPAN.
• None of the reports describe in-the-wild exploitation, and no fixed release is named for CVE-2026-85644.