https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 10:51:13 +0000 https://vulnerability.circl.lu/vuln/cve-2026-73194 <p><strong>Affected:</strong> DBI</p> <p>DBI versions before 1.652 for Perl allow a heap out-of-bounds write via an unvalidated numeric placeholder that sets the binder counter in preparse.</p> <p>preparse reserves seven output bytes per input byte, the width of the longest &#39;:p99999&#39; expansion. The &#39;:N&#39; branch parses the number with `atoi(src)` and assigns it to the binder counter with no range check, so a statement containing &#39;:2147483648&#39; leaves the counter negative (-2147483648 with glibc, where atoi wraps). Each following &#39;?&#39; then expands through `sprintf(start, &#34;:p%d&#34;, idx++)` to &#39;:p-2147483648&#39;, 14 bytes with the terminating NUL where the buffer budgets 7. The placeholder limit added in 1.650 tests the counter against 99,999, which a negative counter passes.</p> <p>Any caller that preparses an untrusted statement into &#39;:pN&#39; style placeholders gets a heap out-of-bounds write that grows with the number of &#39;?&#39; marks following the poisoned placeholder. The &#39;?&#39; and &#39;%s&#39; return styles compare the parsed number against the expected sequence and error out, and are unaffected.</p> <p><strong>Affected:</strong> DBI</p> <p>DBI versions before 1.652 for Perl allow a heap out-of-bounds write via an unvalidated numeric placeholder that sets the binder counter in preparse.</p> <p>preparse reserves seven output bytes per input byte, the width of the longest &#39;:p99999&#39; expansion. The &#39;:N&#39; branch parses the number with `atoi(src)` and assigns it to the binder counter with no range check, so a statement containing &#39;:2147483648&#39; leaves the counter negative (-2147483648 with glibc, where atoi wraps). Each following &#39;?&#39; then expands through `sprintf(start, &#34;:p%d&#34;, idx++)` to &#39;:p-2147483648&#39;, 14 bytes with the terminating NUL where the buffer budgets 7. The placeholder limit added in 1.650 tests the counter against 99,999, which a negative counter passes.</p> <p>Any caller that preparses an untrusted statement into &#39;:pN&#39; style placeholders gets a heap out-of-bounds write that grows with the number of &#39;?&#39; marks following the poisoned placeholder. The &#39;?&#39; and &#39;%s&#39; return styles compare the parsed number against the expected sequence and error out, and are unaffected.</p> https://vulnerability.circl.lu/vuln/cve-2026-73194