CVE-2026-14740

DBI versions before 1.650 for Perl read one byte out-of-bounds in preparse when deleting an initial SQL comment. The preparse method normalises SQL and removes comments. When the SQL starts with a comment line, the deletion of that line during normalisation led to an out-of-bounds read by one byte. The result is a fault on memory-hardened builds and nondeterministic newline retention on normal builds.

• CWE-125

• https://github.com/perl5-dbi/dbi/commit/fc16f9e8b3dd5c65caf1867781ab2bfe2fadcc01.patchPatch
• https://github.com/perl5-dbi/dbi/security/advisories/GHSA-35f4-f8m9-w8xgVendor Advisory
• https://metacpan.org/release/HMBRAND/DBI-1.650/changesRelease Notes
• http://www.openwall.com/lists/oss-security/2026/07/07/17Mailing List, Patch, Third Party Advisory

Published

Jul 7, 2026

Last Modified

Jul 10, 2026

Status

Analyzed

• CVE-2026-14735A vulnerability has been found in code-projects Smart Parkin…7.3
• CVE-2026-14736A vulnerability was found in Ruijie RG-UAC up to 1.0-R1.8.2.…7.3
• CVE-2026-14737A vulnerability was identified in Hanwang e-Face General Man…7.3
• CVE-2026-14738A security flaw has been discovered in exo-explore exo up to…3.7
• CVE-2026-14739DBI versions before 1.650 for Perl have a heap overflow when…9.8
• CVE-2026-1474An out-of-band SQL injection vulnerability (OOB SQLi) has be…7.5
• CVE-2026-14742A vulnerability was determined in langchain-ai langgraph up …3.1
• CVE-2026-14743A vulnerability was identified in code-projects Real State S…7.3
• CVE-2026-14744A security flaw has been discovered in code-projects Real St…7.3
• CVE-2026-14745A weakness has been identified in code-projects Real State S…7.3
• CVE-2026-14746A security vulnerability has been detected in code-projects …7.3
• CVE-2026-14747A vulnerability was detected in code-projects Real State Ser…7.3