CVE-2026-88816: CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')
DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in FetchHashKeyName. fetchrow_hashref uses the string pointer of the FetchHashKeyName attribute as the key name without stringifying it first. When FetchHashKeyName has been set to an integer (IV) or floating-point (NV) value, that pointer is invalid, so reading the key name triggers a segmentation fault. This can be triggered with the following code: my $dbh = DBI->connect( "dbi:ExampleP:", "", "", { RaiseError => 0, PrintError => 0 } ); $dbh->{FetchHashKeyName} = 42; my $sth = $dbh->prepare("select mode, size, name from ."); $sth->execute; $sth->fetchrow_hashref;
AI Analysis
Technical Summary
In Perl DBI versions prior to 1.654, the FetchHashKeyName attribute can be set to a numeric value (integer or floating-point), but fetchrow_hashref uses the string pointer of this attribute as a key name without converting it to a string first. This leads to invalid memory access and segmentation faults due to type confusion (CWE-843). The issue can be triggered by assigning a numeric value to FetchHashKeyName and then calling fetchrow_hashref on a statement handle.
Potential Impact
The vulnerability causes a segmentation fault in the DBI module, which can lead to denial of service in applications using affected versions of DBI. There is no information about code execution or data corruption, only a crash due to invalid memory access.
Mitigation Recommendations
A fix is available in DBI version 1.654 and later. Users should upgrade to version 1.654 or newer to resolve this issue. No other mitigation steps are indicated.
CVE-2026-88816: CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')
Description
DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in FetchHashKeyName. fetchrow_hashref uses the string pointer of the FetchHashKeyName attribute as the key name without stringifying it first. When FetchHashKeyName has been set to an integer (IV) or floating-point (NV) value, that pointer is invalid, so reading the key name triggers a segmentation fault. This can be triggered with the following code: my $dbh = DBI->connect( "dbi:ExampleP:", "", "", { RaiseError => 0, PrintError => 0 } ); $dbh->{FetchHashKeyName} = 42; my $sth = $dbh->prepare("select mode, size, name from ."); $sth->execute; $sth->fetchrow_hashref;
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
In Perl DBI versions prior to 1.654, the FetchHashKeyName attribute can be set to a numeric value (integer or floating-point), but fetchrow_hashref uses the string pointer of this attribute as a key name without converting it to a string first. This leads to invalid memory access and segmentation faults due to type confusion (CWE-843). The issue can be triggered by assigning a numeric value to FetchHashKeyName and then calling fetchrow_hashref on a statement handle.
Potential Impact
The vulnerability causes a segmentation fault in the DBI module, which can lead to denial of service in applications using affected versions of DBI. There is no information about code execution or data corruption, only a crash due to invalid memory access.
Mitigation Recommendations
A fix is available in DBI version 1.654 and later. Users should upgrade to version 1.654 or newer to resolve this issue. No other mitigation steps are indicated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- CPANSec
- Date Reserved
- 2026-09-10T08:47:49.901Z
- State
- PUBLISHED
Threat ID: 6aba96ccf7a7c54106ee8aee
Added to database: 09/28/2026, 16:33:16 UTC
Last enriched: 09/28/2026, 16:47:47 UTC
Last updated: 09/29/2026, 01:57:22 UTC
Views: 13
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.