CVE-2026-14739

CriticalCVSS 9.8/10Last modified Jul 10, 2026

Description

DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders.

The fix for CVE-2026-10879 did not allocate enough memory to handle approximately 1.2-million placeholders.

DBI version 1.650 sets a hard limit of 99,999 placeholders.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

No affected versions have been published.

Timeline

Published
Jul 7, 2026
Last modified
Jul 10, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-14747.5An out-of-band SQL injection vulnerability (OOB SQLi) has been detected in the Performance Evaluation (EDD) application developed by GabinetCVE-2026-147409.1DBI versions before 1.650 for Perl read one byte out-of-bounds in preparse when deleting an initial SQL comment. The preparse method normalCVE-2026-147417.5HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex backtracking in parse_date. parse_date() matches the datCVE-2026-147423.1A vulnerability was determined in langchain-ai langgraph up to 1.2.4. The affected element is the function _freeze of the file libs/langgrapCVE-2026-147437.3A vulnerability was identified in code-projects Real State Services 1.0. The impacted element is an unknown function of the file /normalHomeCVE-2026-147447.3A security flaw has been discovered in code-projects Real State Services 1.0. This affects an unknown function of the file /normalHomeRent.pCVE-2026-147457.3A weakness has been identified in code-projects Real State Services 1.0. This impacts an unknown function of the file /single-list_rent.php.CVE-2026-147467.3A security vulnerability has been detected in code-projects Real State Services 1.0. Affected is an unknown function of the file /addprojectCVE-2026-147477.3A vulnerability was detected in code-projects Real State Services 1.0. Affected by this vulnerability is an unknown functionality of the filCVE-2026-147486.3A flaw has been found in AIAnytime Awesome-MCP-Server up to a884bb51bcd99e08e14fd712c749d55d9d9a13ab. Affected by this issue is some unknownCVE-2026-147497.3A vulnerability was identified in mjperpinosa stumasy up to 327d1b0f2915ba79d7ef8ebb74553e987609d9be. Impacted is the function eval of the fCVE-2026-14757.5An out-of-band SQL injection vulnerability (OOB SQLi) has been detected in the Performance Evaluation (EDD) application developed by Gabinet
CVE-2026-14739: Critical severity, CVSS 9.8 | Vulnix