CVE-2026-9698 is a buffer overflow in the Perl DBI module before version 1.648, rated 9.8. Error messages were written into a 200 byte buffer with no length limit when RaiseError, PrintError or HandleError was set. Upgrade to DBI 1.648 or later.
What's affected
- Product: DBI, the database interface module for Perl, on CPAN.
- Affected: versions before 1.648.
- Fixed: 1.648, released on 4 June 2026 according to the CPAN Security Group announcement.
- Trigger: an application where an attacker can influence error text and that has RaiseError, PrintError or HandleError turned on.
How to check if you're exposed
Print the installed version on each host:
perl -MDBI -e 'print "$DBI::VERSION\n"'
On packaged systems, ask the package manager. Linux distributions often backport fixes without changing the upstream number, so use the vendor's advisory rather than comparing versions alone.
rpm -q perl-DBI
dpkg -l | grep -i libdbi-perl
Red Hat has published errata for this CVE, listed in the record as RHSA-2026:38512, RHSA-2026:38513 and RHSA-2026:38901. Check them if you run Red Hat based systems.
What to do now
- Upgrade DBI to 1.648 or later from CPAN, or install your distribution's patched package.
- Rebuild containers and bundled Perl environments, such as carton or local lib directories, that carry their own copy of DBI.
- Find applications that set RaiseError, PrintError or HandleError and can echo attacker influenced text into database errors. Those are the first ones to patch.
- Check vendored copies of DBI inside application bundles and appliance images.
- Re-run your dependency scan to confirm no old copy remains.
Why it matters
The record lists CWE-120 and CWE-787, a classic buffer copy without a size check and the out of bounds write that follows. The fix was a small change in how the module stores error text. The size of the buffer was the problem, since the message length was never checked against it.
The score of 9.8 assumes the worst case: network reach, no privileges and no user action. Reality depends on the application, because an attacker has to be able to shape the text of a database error. Applications that include user input in queries or that pass database messages through are the likelier candidates. The record does not mark the CVE as exploited in the wild.
Reachability matters here. A copy of DBI that sits in a project but is never called with those error settings is much lower priority than one in a request path. A reachability analysis helps you sort that out, as in this demo.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does my Perl app need to use RaiseError to be at risk?
The advisory names RaiseError, PrintError and HandleError as the paths that wrote the message into the small buffer. If none of them is set, the described path is not used, but upgrading is still the safe fix.
Sources
- oss-security announcement for CVE-2026-9698
- DBI 1.648 changes on MetaCPAN
- Gold entry for CVE-2026-9698
Last reviewed: 19 October 2026.
