CVE-2026-10879

Name of the Vulnerable Software and Affected Versions DBI versions prior to 1.648

Description A heap overflow occurs when preparsing SQL statements containing more than 9 binders. The preparse() function expands SQL placeholder characters into numbered binders using the format :pN, but the buffer allocation is limited to three characters per binder. This leads to an overflow when placeholders reach 10 or more, as they require four or more characters (e.g., placeholders 10-99 require four characters, and 100-999 require five).

Recommendations Update to version 1.648.