huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2026-9698: DBI: DBI: Buffer overflow in error handling can lead to arbitrary code execution
Component: DBI
Severity: Important
CWE: CWE-120 (Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'))
CVSS v3: 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H)
Public date: 2026-06-09T07:22:25.892000+00:00

A flaw was found in DBI, a Perl database interface. This vulnerability allows an attacker to trigger a buffer overflow by manipulating error messages within an application. When specific error handling options are active, an attacker can provide oversized error text, which may lead to arbitrary code execution or a denial of service (DoS).

Statement: Exploitation of this vulnerability requires that an attacker can provide values to an endpoint using perl-DBI which trigger certain errors. The attacker has no means of directly controlling the location and thus consequences of the buffer overflow, making the most likely outcome a denial-of-service due to corruption of the application's memory.

Affected upstream versions: <= 1.647
Fixed upstream versions: 1.648
Upstream repository: https://github.com/perl5-dbi/dbi
Upstream fix commit: bfe5d73c162d2d1f761a639a0aa33aad6a9eb54e