CVE-2026-15043

Name of the Vulnerable Software and Affected Versions DBI::SQL::Nano versions 1.42 through 1.650

Description DBI::SQL::Nano, a built-in mini-SQL engine for DBI, incorrectly evaluates WHERE predicates in certain scenarios. Specifically, within the non-numeric string branch of the is matched() function, the <= operator is evaluated using Perl's ge operator, and the >= operator is evaluated using Perl's le operator. This occurs when SQL::Nano serves as the fallback query engine for file-backed drivers (such as DBD::File, DBD::DBM, or CSV-style drivers) when SQL::Statement is absent or when DBI SQL NANO=1 is set. This logic inversion can lead to the silent return of incorrect data rows, which may impact applications relying on these filters for authorization or policy enforcement.

Recommendations Update DBI::SQL::Nano to version 1.651.