Answer in brief
CVE-2026-14740 records a Critical severity (CVSS 9.1) vulnerability in DBI versions before 1.650 for Perl read one byte out-of-bounds in preparse when deleting an initial SQL comment. The current sources do not mark it as known exploited. The current feed maps HMBRAND/DBI (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 9.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps HMBRAND/DBI (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| HMBRAND/DBIgeneric | >=0 <1.650 | 1.650 |
Published upstream
Jul 7, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Jul 10, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jul 8, 2026
DBI versions before 1.650 for Perl read one byte out-of-bounds in preparse when deleting an initial SQL comment. The preparse method normalises SQL and removes comments. When the SQL starts with a comment line, the deletion of that line during normalisation led to an out-of-bounds read by one byte. The result is a fault on memory-hardened builds and nondeterministic newline retention on normal builds.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2026-14740 records a Critical severity (CVSS 9.1) vulnerability in DBI versions before 1.650 for Perl read one byte out-of-bounds in preparse when deleting an initial SQL comment. The current sources do not mark it as known exploited. The current feed maps HMBRAND/DBI (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 9.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps HMBRAND/DBI (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| HMBRAND/DBIgeneric | >=0 <1.650 | 1.650 |
Published upstream
Jul 7, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Jul 10, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jul 8, 2026
DBI versions before 1.650 for Perl read one byte out-of-bounds in preparse when deleting an initial SQL comment. The preparse method normalises SQL and removes comments. When the SQL starts with a comment line, the deletion of that line during normalisation led to an out-of-bounds read by one byte. The result is a fault on memory-hardened builds and nondeterministic newline retention on normal builds.
Quoted source text, attributed separately from HOL analysis.