An update for perl-DBI is now available for openEuler-24.03-LTS-SP1 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2026-3520 Final 1.0 1.0 2026-08-30 Initial 2026-08-30 2026-08-30 openEuler SA Tool V1.0 2026-08-30 perl-DBI security update An update for perl-DBI is now available for openEuler-24.03-LTS-SP1 The DBI is the standard database interface module for Perl. It defines a set of methods, variables and conventions that provide a consistent database interface independent of the actual database being used. It is important to remember that the DBI is just an interface. The DBI is a layer of "glue" between an application and one or more database driver modules. It is the driver modules which do most of the real work. The DBI provides a standard interface and framework for the drivers to operate within. Security Fix(es): DBI versions before 1.652 for Perl allow a heap out-of-bounds write on 32-bit perl via an integer wraparound in the output buffer size computed by preparse. preparse reserves its output buffer with `newSV(strlen(statement) * 7 + 16)`, budgeting seven output bytes per input byte for the longest ':p99999' expansion. The product is computed in STRLEN, which is 32 bits wide on a 32-bit perl build, so a statement of 613,566,757 bytes multiplies to 4,294,967,299, wraps modulo 2^32 to 3, and reserves 19 bytes. The parser then copies the statement out through a raw pointer with no capacity check, writing the whole 585 MB input past the end of the allocation. The 99,999 placeholder limit does not bound this path, which is reached by ordinary non-placeholder content. Any caller that passes an untrusted statement of that length to preparse on a 32-bit perl gets a heap out-of-bounds write of attacker controlled bytes. Builds with a 64-bit STRLEN are not affected, since the wrap there needs a statement of about 2.3 exabytes.(CVE-2026-73193) DBI versions before 1.652 for Perl allow a heap out-of-bounds write via an unvalidated numeric placeholder that sets the binder counter in preparse. preparse reserves seven output bytes per input byte, the width of the longest ':p99999' expansion. The ':N' branch parses the number with `atoi(src)` and assigns it to the binder counter with no range check, so a statement containing ':2147483648' leaves the counter negative (-2147483648 with glibc, where atoi wraps). Each following '?' then expands through `sprintf(start, ":p%d", idx++)` to ':p-2147483648', 14 bytes with the terminating NUL where the buffer budgets 7. The placeholder limit added in 1.650 tests the counter against 99,999, which a negative counter passes. Any caller that preparses an untrusted statement into ':pN' style placeholders gets a heap out-of-bounds write that grows with the number of '?' marks following the poisoned placeholder. The '?' and '%s' return styles compare the parsed number against the expected sequence and error out, and are unaffected.(CVE-2026-73194) An update for perl-DBI is now available for openEuler-24.03-LTS-SP1. openEuler Security has rated this update as having a security impact of critical. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. Critical perl-DBI https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3520 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-73193 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-73194 https://nvd.nist.gov/vuln/detail/CVE-2026-73193 https://nvd.nist.gov/vuln/detail/CVE-2026-73194 openEuler-24.03-LTS-SP1 perl-DBI-1.643-8.oe2403sp1.aarch64.rpm perl-DBI-debuginfo-1.643-8.oe2403sp1.aarch64.rpm perl-DBI-debugsource-1.643-8.oe2403sp1.aarch64.rpm perl-DBI-1.643-8.oe2403sp1.src.rpm perl-DBI-1.643-8.oe2403sp1.x86_64.rpm perl-DBI-debuginfo-1.643-8.oe2403sp1.x86_64.rpm perl-DBI-debugsource-1.643-8.oe2403sp1.x86_64.rpm perl-DBI-help-1.643-8.oe2403sp1.noarch.rpm DBI versions before 1.652 for Perl allow a heap out-of-bounds write on 32-bit perl via an integer wraparound in the output buffer size computed by preparse. preparse reserves its output buffer with `newSV(strlen(statement) * 7 + 16)`, budgeting seven output bytes per input byte for the longest ':p99999' expansion. The product is computed in STRLEN, which is 32 bits wide on a 32-bit perl build, so a statement of 613,566,757 bytes multiplies to 4,294,967,299, wraps modulo 2^32 to 3, and reserves 19 bytes. The parser then copies the statement out through a raw pointer with no capacity check, writing the whole 585 MB input past the end of the allocation. The 99,999 placeholder limit does not bound this path, which is reached by ordinary non-placeholder content. Any caller that passes an untrusted statement of that length to preparse on a 32-bit perl gets a heap out-of-bounds write of attacker controlled bytes. Builds with a 64-bit STRLEN are not affected, since the wrap there needs a statement of about 2.3 exabytes. 2026-08-30 CVE-2026-73193 openEuler-24.03-LTS-SP1 Critical 9.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H perl-DBI security update 2026-08-30 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3520 DBI versions before 1.652 for Perl allow a heap out-of-bounds write via an unvalidated numeric placeholder that sets the binder counter in preparse. preparse reserves seven output bytes per input byte, the width of the longest ':p99999' expansion. The ':N' branch parses the number with `atoi(src)` and assigns it to the binder counter with no range check, so a statement containing ':2147483648' leaves the counter negative (-2147483648 with glibc, where atoi wraps). Each following '?' then expands through `sprintf(start, ":p%d", idx++)` to ':p-2147483648', 14 bytes with the terminating NUL where the buffer budgets 7. The placeholder limit added in 1.650 tests the counter against 99,999, which a negative counter passes. Any caller that preparses an untrusted statement into ':pN' style placeholders gets a heap out-of-bounds write that grows with the number of '?' marks following the poisoned placeholder. The '?' and '%s' return styles compare the parsed number against the expected sequence and error out, and are unaffected. 2026-08-30 CVE-2026-73194 openEuler-24.03-LTS-SP1 High 7.7 AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H perl-DBI security update 2026-08-30 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3520