CVE-2026-60082: 
CBL Mariner vulnerability analysis and mitigation

CVE-2026-60082 is an out-of-bounds read vulnerability in the Perl DBI module (versions before 1.651) affecting the internal XS row-buffer helper _set_fbav in DBI.xs. When a statement handle has zero declared fields but a non-empty source row is supplied, the grow loop begins iteration at index -1, reading one slot before the array boundary (CWE-125). The vulnerability was published on July 14, 2026, assigned by CPANSec, and affects all DBI releases prior to 1.651 by vendor HMBRAND. It carries a CVSS v3.1 base score of 9.1 (Critical) (GitHub Advisory, Red Hat Bugzilla).

The root cause is an out-of-bounds read (CWE-125) in the _set_fbav function within DBI.xs. When dst_fields == 0 and src_fields > 0, the grow loop for(i = dst_fields-1; i < src_fields; ++i) starts at i = -1, causing AvARRAY(dst_av)[-1] to be dereferenced — one slot before the allocated array. On standard builds this reads a garbage SV* pointer and typically crashes in sv_setsv; under ASAN it is reported as a heap-buffer-overflow READ of 8 bytes. The flaw is reachable via DBD::Sponge->prepare() with NAME => [] and a non-empty rows array, or through any DBI::Gofer/ProxyServer peer that supplies inconsistent Sponge-style metadata and row data. The fix (committed July 10, 2026) adds an explicit croak when dst_fields == 0 and the source row is non-empty, preventing the invalid resize path from executing (GitHub Advisory, Patch Commit).

Successful exploitation causes a memory-safety fault: on standard Perl builds the process crashes (denial of service), while on hardened/ASAN builds an out-of-bounds read of heap memory is confirmed, potentially exposing sensitive in-memory data (information disclosure). The vulnerability has high availability and high confidentiality impact with no integrity impact, and is exploitable over the network without authentication or user interaction. Applications using DBI with network-accessible interfaces (e.g., DBI::Gofer, ProxyServer, or any DBD that accepts externally-supplied metadata) are at greatest risk of remote exploitation (GitHub Advisory, Red Hat Bugzilla).

1. Identify target: Locate a Perl application using DBI versions before 1.651 that exposes a network-accessible interface accepting externally-supplied database metadata and row data (e.g., DBI::Gofer server, ProxyServer, or a custom DBD using Sponge-style prepare).
2. Craft inconsistent metadata: Prepare a request that calls DBD::Sponge->prepare() (or equivalent) with NAME => [] (zero columns) paired with a non-empty rows array (e.g., rows => [['value1', 'value2']]), creating a mismatch between declared field count (0) and actual row width.
3. Trigger the fetch: Issue a fetchrow_arrayref or equivalent call on the prepared statement handle, which internally invokes _set_fbav in DBI.xs with dst_fields == 0 and src_fields > 0.
4. Trigger out-of-bounds read: The grow loop starts at i = -1, causing AvARRAY(dst_av)[-1] to be read — on standard builds this crashes the process (DoS); on hardened builds it reads adjacent heap memory.
5. Achieve objective: Depending on build configuration, the attacker achieves either a process crash (denial of service) or potential leakage of heap memory contents (information disclosure) (GitHub Advisory, Patch Commit).

• Logs: Application logs showing unexpected croak or fatal errors from _set_fbav in DBI (post-patch); pre-patch logs may show segmentation faults or Perl process crashes with no clear SQL error.
• Process: Unexpected termination of Perl DBI-based service processes (e.g., DBI::Gofer daemons, ProxyServer workers) without a corresponding database error; core dump files generated by the Perl interpreter.
• Network: Unusual or malformed DBI::Gofer/ProxyServer protocol messages containing zero-column metadata paired with non-empty row data sent to DBI listener ports.
• File System: Core dump files (e.g., core.*) in the working directory of the DBI application process, potentially containing heap memory contents (GitHub Advisory).

Upgrade DBI to version 1.651 or later, which introduces an explicit croak when a zero-field statement handle receives a non-empty row, preventing the invalid memory access (GitHub Advisory, MetaCPAN Release). As a workaround where immediate upgrade is not possible, restrict network access to DBI::Gofer or ProxyServer interfaces to trusted sources only, and implement application-level validation to ensure statement handle metadata (field count) is consistent with supplied row data before calling prepare. Microsoft Azure Linux 3 users should apply the updated azl3_perl-dbi package (Microsoft); openSUSE users should apply the security update announced via the openSUSE security mailing list.

The vulnerability was disclosed publicly on July 14, 2026 via the oss-security mailing list by Robert Rothenberg (CPANSec), who also authored the fix (oss-security). The GitHub security advisory rates the severity as "Moderate" despite the high CVSS score, noting that attacker reach is narrow since the caller must control both field metadata and row width. A Bluesky post from the infosec.skyfleet.blue account noted the disclosure shortly after publication. No significant media coverage or major vendor statements beyond Red Hat and Microsoft patch tracking have been observed.