Vulnerability-Lookup

ubuntu-cve-2026-73193

Vulnerability from osv_ubuntu

Published

2026-08-17 00:00

Modified

2026-08-17 00:00

Summary

Details

DBI versions before 1.652 for Perl allow a heap out-of-bounds write on 32-bit perl via an integer wraparound in the output buffer size computed by preparse. preparse reserves its output buffer with newSV(strlen(statement) * 7 + 16), budgeting seven output bytes per input byte for the longest ':p99999' expansion. The product is computed in STRLEN, which is 32 bits wide on a 32-bit perl build, so a statement of 613,566,757 bytes multiplies to 4,294,967,299, wraps modulo 2^32 to 3, and reserves 19 bytes. The parser then copies the statement out through a raw pointer with no capacity check, writing the whole 585 MB input past the end of the allocation. The 99,999 placeholder limit does not bound this path, which is reached by ordinary non-placeholder content. Any caller that passes an untrusted statement of that length to preparse on a 32-bit perl gets a heap out-of-bounds write of attacker controlled bytes. Builds with a 64-bit STRLEN are not affected, since the wrap there needs a statement of about 2.3 exabytes.

Severity

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2026-73193	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-73193	REPORT
	https://lists.security.metacpan.org/cve-announce/…	REPORT
	https://github.com/perl5-dbi/dbi/commit/c751ae5a5…	REPORT
	https://github.com/perl5-dbi/dbi/security/advisor…	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-14739	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libdbi-perl",
            "binary_version": "1.630-1ubuntu0.1~esm6"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:14.04:LTS",
        "name": "libdbi-perl",
        "purl": "pkg:deb/ubuntu/libdbi-perl@1.630-1ubuntu0.1~esm6?arch=source\u0026distro=esm-infra-legacy/trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.627-1",
        "1.628-1",
        "1.630-1",
        "1.630-1ubuntu0.1~esm1",
        "1.630-1ubuntu0.1~esm4",
        "1.630-1ubuntu0.1~esm5",
        "1.630-1ubuntu0.1~esm6"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libdbi-perl",
            "binary_version": "1.634-1ubuntu0.2+esm2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:16.04:LTS",
        "name": "libdbi-perl",
        "purl": "pkg:deb/ubuntu/libdbi-perl@1.634-1ubuntu0.2+esm2?arch=source\u0026distro=esm-infra-legacy/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.633-1",
        "1.634-1",
        "1.634-1build1",
        "1.634-1ubuntu0.1",
        "1.634-1ubuntu0.2",
        "1.634-1ubuntu0.2+esm1",
        "1.634-1ubuntu0.2+esm2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libdbi-perl",
            "binary_version": "1.640-1ubuntu0.3+esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:18.04:LTS",
        "name": "libdbi-perl",
        "purl": "pkg:deb/ubuntu/libdbi-perl@1.640-1ubuntu0.3+esm1?arch=source\u0026distro=esm-infra/bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.637-1",
        "1.639-1",
        "1.640-1",
        "1.640-1ubuntu0.1",
        "1.640-1ubuntu0.2",
        "1.640-1ubuntu0.3",
        "1.640-1ubuntu0.3+esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libdbi-perl",
            "binary_version": "1.643-1ubuntu0.1+esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:20.04:LTS",
        "name": "libdbi-perl",
        "purl": "pkg:deb/ubuntu/libdbi-perl@1.643-1ubuntu0.1+esm1?arch=source\u0026distro=esm-infra/focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.642-1",
        "1.642-1build1",
        "1.643-1",
        "1.643-1ubuntu0.1",
        "1.643-1ubuntu0.1+esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libdbi-perl",
            "binary_version": "1.643-3ubuntu0.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "libdbi-perl",
        "purl": "pkg:deb/ubuntu/libdbi-perl@1.643-3ubuntu0.1?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.643-3build2",
        "1.643-3build3",
        "1.643-3ubuntu0.1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libdbi-perl",
            "binary_version": "1.643-4ubuntu0.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "libdbi-perl",
        "purl": "pkg:deb/ubuntu/libdbi-perl@1.643-4ubuntu0.1?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.643-4",
        "1.643-4build1",
        "1.643-4build2",
        "1.643-4build3",
        "1.643-4ubuntu0.1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libdbi-perl",
            "binary_version": "1.647-1ubuntu0.26.04.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "libdbi-perl",
        "purl": "pkg:deb/ubuntu/libdbi-perl@1.647-1ubuntu0.26.04.1?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.647-1",
        "1.647-1build1",
        "1.647-1ubuntu0.26.04.1"
      ]
    }
  ],
  "aliases": [],
  "details": "DBI versions before 1.652 for Perl allow a heap out-of-bounds write on 32-bit perl via an integer wraparound in the output buffer size computed by preparse. preparse reserves its output buffer with `newSV(strlen(statement) * 7 + 16)`, budgeting seven output bytes per input byte for the longest \u0027:p99999\u0027 expansion. The product is computed in STRLEN, which is 32 bits wide on a 32-bit perl build, so a statement of 613,566,757 bytes multiplies to 4,294,967,299, wraps modulo 2^32 to 3, and reserves 19 bytes. The parser then copies the statement out through a raw pointer with no capacity check, writing the whole 585 MB input past the end of the allocation. The 99,999 placeholder limit does not bound this path, which is reached by ordinary non-placeholder content. Any caller that passes an untrusted statement of that length to preparse on a 32-bit perl gets a heap out-of-bounds write of attacker controlled bytes. Builds with a 64-bit STRLEN are not affected, since the wrap there needs a statement of about 2.3 exabytes.",
  "id": "UBUNTU-CVE-2026-73193",
  "modified": "2026-08-17T00:00:00Z",
  "published": "2026-08-17T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-73193"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-73193"
    },
    {
      "type": "REPORT",
      "url": "https://lists.security.metacpan.org/cve-announce/msg/42707360/"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/perl5-dbi/dbi/commit/c751ae5a5a6f56c2f8284f37c1f4d43500352ef1.patch"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/perl5-dbi/dbi/security/advisories/GHSA-wj3v-c3hh-mhqr"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14739"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-73193"
  ]
}

CVE-2026-73193 (GCVE-0-2026-73193)

Vulnerability from cvelistv5 – Published: 2026-08-15 12:09 – Updated: 2026-08-17 20:31

Title

DBI versions before 1.652 for Perl allow a heap out-of-bounds write on 32-bit perl via an integer wraparound in the output buffer size computed by preparse

Summary

DBI versions before 1.652 for Perl allow a heap out-of-bounds write on 32-bit perl via an integer wraparound in the output buffer size computed by preparse. preparse reserves its output buffer with `newSV(strlen(statement) * 7 + 16)`, budgeting seven output bytes per input byte for the longest ':p99999' expansion. The product is computed in STRLEN, which is 32 bits wide on a 32-bit perl build, so a statement of 613,566,757 bytes multiplies to 4,294,967,299, wraps modulo 2^32 to 3, and reserves 19 bytes. The parser then copies the statement out through a raw pointer with no capacity check, writing the whole 585 MB input past the end of the allocation. The 99,999 placeholder limit does not bound this path, which is reached by ordinary non-placeholder content. Any caller that passes an untrusted statement of that length to preparse on a 32-bit perl gets a heap out-of-bounds write of attacker controlled bytes. Builds with a 64-bit STRLEN are not affected, since the wrap there needs a statement of about 2.3 exabytes.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-17 20:30 UTC

CWE

CWE-190 - Integer Overflow or Wraparound
CWE-787 - Out-of-bounds Write

Assigner

CPANSec

References

3 references

URL	Tags
https://www.cve.org/CVERecord?id=CVE-2026-14739	related
https://github.com/perl5-dbi/dbi/security/advisor…	vendor-advisory
https://github.com/perl5-dbi/dbi/commit/c751ae5a5…	patch

Impacted products

1 product

Vendor	Product	Version
		Affected: 0 , < 1.652 (custom)

Credits

Chrysostomos Manousis

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-73193",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-17T20:30:59.439025Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-17T20:31:48.261Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/perl5-dbi/dbi/security/advisories/GHSA-wj3v-c3hh-mhqr"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://cpan.org/modules",
          "defaultStatus": "unaffected",
          "modules": [
            "DBI"
          ],
          "packageName": "DBI",
          "packageURL": "pkg:cpan/DBI",
          "programFiles": [
            "DBI.xs"
          ],
          "programRoutines": [
            {
              "name": "preparse"
            }
          ],
          "repo": "https://github.com/perl5-dbi/dbi",
          "versions": [
            {
              "lessThan": "1.652",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Chrysostomos Manousis"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "DBI versions before 1.652 for Perl allow a heap out-of-bounds write on 32-bit perl via an integer wraparound in the output buffer size computed by preparse.\n\npreparse reserves its output buffer with `newSV(strlen(statement) * 7 + 16)`, budgeting seven output bytes per input byte for the longest \u0027:p99999\u0027 expansion. The product is computed in STRLEN, which is 32 bits wide on a 32-bit perl build, so a statement of 613,566,757 bytes multiplies to 4,294,967,299, wraps modulo 2^32 to 3, and reserves 19 bytes. The parser then copies the statement out through a raw pointer with no capacity check, writing the whole 585 MB input past the end of the allocation. The 99,999 placeholder limit does not bound this path, which is reached by ordinary non-placeholder content.\n\nAny caller that passes an untrusted statement of that length to preparse on a 32-bit perl gets a heap out-of-bounds write of attacker controlled bytes. Builds with a 64-bit STRLEN are not affected, since the wrap there needs a statement of about 2.3 exabytes."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190 Integer Overflow or Wraparound",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "CWE-787 Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-15T12:09:03.948Z",
        "orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
        "shortName": "CPANSec"
      },
      "references": [
        {
          "tags": [
            "related"
          ],
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-14739"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/perl5-dbi/dbi/security/advisories/GHSA-wj3v-c3hh-mhqr"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/perl5-dbi/dbi/commit/c751ae5a5a6f56c2f8284f37c1f4d43500352ef1.patch"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to DBI 1.652 or later."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "DBI versions before 1.652 for Perl allow a heap out-of-bounds write on 32-bit perl via an integer wraparound in the output buffer size computed by preparse",
      "workarounds": [
        {
          "lang": "en",
          "value": "On 32-bit depoyments that cannot be upgraded, limit the size of SQL statements under 292 megabytes."
        }
      ],
      "x_generator": {
        "engine": "cpansec-cna-tool 0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
    "assignerShortName": "CPANSec",
    "cveId": "CVE-2026-73193",
    "datePublished": "2026-08-15T12:09:03.948Z",
    "dateReserved": "2026-08-11T11:58:19.137Z",
    "dateUpdated": "2026-08-17T20:31:48.261Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

ubuntu-cve-2026-73193

Vulnerability from osv_ubuntu

CVE-2026-73193 (GCVE-0-2026-73193)

Tags

Sightings

Nomenclature