CVE-2026-88816

Name of the Vulnerable Software and Affected Versions DBI versions prior to 1.654

Description Perl DBI incorrectly treats numeric values as strings within the FetchHashKeyName attribute. The fetchrow hashref() function uses the string pointer of FetchHashKeyName as the key name without performing stringification first. If FetchHashKeyName is assigned an integer (IV) or floating-point (NV) value, the resulting pointer is invalid, leading to a segmentation fault when the key name is read.

Recommendations Update to version 1.654 or later.