CVE-2026-88815

A flaw was found in perl-DBI. When casting numeric values to the SQL_NUMERIC type using the sql_type_cast function, the component incorrectly handles numeric values as strings without converting them first. An attacker capable of supplying numeric input to an affected application can trigger an invalid memory read, causing the application to crash and resulting in a Denial of Service (DoS).

Red Hat rates this vulnerability as Important due to the potential for unauthenticated remote attackers to trigger an immediate denial of service by terminating network-facing Perl applications. Although exploitation is limited to process termination without compromising confidentiality or integrity, the flaw can be reached without authentication in services that pass untrusted input into database query casting routines. perl-DBI is standard infrastructure across enterprise deployments, and applications exposing database interactions to external input are directly susceptible to crashing upon evaluating unstringified numeric values.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.