{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-15043", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "state": "PUBLISHED", "assignerShortName": "CPANSec", "dateReserved": "2026-07-08T11:48:00.718Z", "datePublished": "2026-07-14T09:44:25.733Z", "dateUpdated": "2026-07-14T15:32:33.329Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "DBI", "product": "DBI::SQL::Nano", "programFiles": ["lib/DBI/SQL/Nano.pm"], "programRoutines": [{"name": "DBI::SQL::Nano::is_matched"}], "repo": "https://github.com/perl5-dbi/dbi", "vendor": "HMBRAND", "versions": [{"lessThan": "1.651", "status": "affected", "version": "1.42", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "DBI::SQL::Nano versions from 1.42 before 1.651 for Perl have inverted <= and >= SQL operators on text.\n\nDBI::SQL::Nano, DBI's built-in mini-SQL engine, evaluated WHERE predicates incorrectly in some cases. In the non-numeric string branch of the is_matched method, <= was evaluated using Perl's ge operator, and >= was evaluated using Perl's le operator.\n\nSQL::Nano is the fallback query engine for DBI's file-backed drivers (DBD::File, DBD::DBM, CSV-style drivers) whenever SQL::Statement is not installed, and is forced whenever DBI_SQL_NANO=1. Queries over such tables use these predicates directly.\n\nThe impact depends on the context. Where an application relies on a WHERE clause to filter file-backed data for policy or authorization, an inverted <=/>= comparison silently returns the wrong rows."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-480", "description": "CWE-480 Use of Incorrect Operator", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-07-14T15:32:33.329Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://github.com/perl5-dbi/dbi/security/advisories/GHSA-mv45-ff6j-x9jp"}, {"tags": ["release-notes"], "url": "https://metacpan.org/release/HMBRAND/DBI-1.651/changes"}, {"tags": ["patch"], "url": "https://github.com/perl5-dbi/dbi/commit/e9742ef85a75867cbd696860e3bf3e32b681f98d.patch"}], "solutions": [{"lang": "en", "value": "Upgrade to DBI 1.651 or later."}], "source": {"discovery": "UNKNOWN"}, "timeline": [{"lang": "en", "time": "2004-03-12T00:00:00.000Z", "value": "Version 1.42 released with DBI::SQL::Nano."}, {"lang": "en", "time": "2026-07-10T00:00:00.000Z", "value": "Patch that fixes DBI::SQL::Nano merged."}, {"lang": "en", "time": "2026-07-14T00:00:00.000Z", "value": "Version 1.651 released."}], "title": "DBI::SQL::Nano versions from 1.42 before 1.651 for Perl have inverted <= and >= SQL operators on text", "workarounds": [{"lang": "en", "value": "For deployments that cannot upgrade, apply the patch or install SQL::Statement."}], "x_generator": {"engine": "cpansec-cna-tool 0.1"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/07/14/9"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-07-14T11:30:25.876Z"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-07-14T14:14:59.552000Z", "id": "CVE-2026-15043", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-14T14:16:12.284Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/07/14/9"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-07-14T11:30:25.876Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-15043", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-14T14:14:59.552000Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-14T14:14:52.942Z"}}], "cna": {"title": "DBI::SQL::Nano versions from 1.42 before 1.651 for Perl have inverted <= and >= SQL operators on text", "source": {"discovery": "UNKNOWN"}, "affected": [{"repo": "https://github.com/perl5-dbi/dbi", "vendor": "HMBRAND", "product": "DBI::SQL::Nano", "versions": [{"status": "affected", "version": "1.42", "lessThan": "1.651", "versionType": "custom"}], "packageName": "DBI", "programFiles": ["lib/DBI/SQL/Nano.pm"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "DBI::SQL::Nano::is_matched"}]}], "timeline": [{"lang": "en", "time": "2004-03-12T00:00:00.000Z", "value": "Version 1.42 released with DBI::SQL::Nano."}, {"lang": "en", "time": "2026-07-10T00:00:00.000Z", "value": "Patch that fixes DBI::SQL::Nano merged."}, {"lang": "en", "time": "2026-07-14T00:00:00.000Z", "value": "Version 1.651 released."}], "solutions": [{"lang": "en", "value": "Upgrade to DBI 1.651 or later."}], "references": [{"url": "https://github.com/perl5-dbi/dbi/security/advisories/GHSA-mv45-ff6j-x9jp", "tags": ["vendor-advisory"]}, {"url": "https://metacpan.org/release/HMBRAND/DBI-1.651/changes", "tags": ["release-notes"]}, {"url": "https://github.com/perl5-dbi/dbi/commit/e9742ef85a75867cbd696860e3bf3e32b681f98d.patch", "tags": ["patch"]}], "workarounds": [{"lang": "en", "value": "For deployments that cannot upgrade, apply the patch or install SQL::Statement."}], "x_generator": {"engine": "cpansec-cna-tool 0.1"}, "descriptions": [{"lang": "en", "value": "DBI::SQL::Nano versions from 1.42 before 1.651 for Perl have inverted <= and >= SQL operators on text.\n\nDBI::SQL::Nano, DBI's built-in mini-SQL engine, evaluated WHERE predicates incorrectly in some cases. In the non-numeric string branch of the is_matched method, <= was evaluated using Perl's ge operator, and >= was evaluated using Perl's le operator.\n\nSQL::Nano is the fallback query engine for DBI's file-backed drivers (DBD::File, DBD::DBM, CSV-style drivers) whenever SQL::Statement is not installed, and is forced whenever DBI_SQL_NANO=1. Queries over such tables use these predicates directly.\n\nThe impact depends on the context. Where an application relies on a WHERE clause to filter file-backed data for policy or authorization, an inverted <=/>= comparison silently returns the wrong rows."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-480", "description": "CWE-480 Use of Incorrect Operator"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-07-14T15:32:33.329Z"}}}, "cveMetadata": {"cveId": "CVE-2026-15043", "state": "PUBLISHED", "dateUpdated": "2026-07-14T15:32:33.329Z", "dateReserved": "2026-07-08T11:48:00.718Z", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "datePublished": "2026-07-14T09:44:25.733Z", "assignerShortName": "CPANSec"}, "dataVersion": "5.2"}

{}

{"bugzilla": {"description": "DBI::SQL::Nano: DBI::SQL::Nano: Incorrect SQL operator evaluation can lead to incorrect data filtering.", "id": "2499934", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499934"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "status": "draft"}, "cwe": "CWE-480", "details": ["DBI::SQL::Nano versions from 1.42 before 1.651 for Perl have inverted <= and >= SQL operators on text.\nDBI::SQL::Nano, DBI's built-in mini-SQL engine, evaluated WHERE predicates incorrectly in some cases. In the non-numeric string branch of the is_matched method, <= was evaluated using Perl's ge operator, and >= was evaluated using Perl's le operator.\nSQL::Nano is the fallback query engine for DBI's file-backed drivers (DBD::File, DBD::DBM, CSV-style drivers) whenever SQL::Statement is not installed, and is forced whenever DBI_SQL_NANO=1. Queries over such tables use these predicates directly.\nThe impact depends on the context. Where an application relies on a WHERE clause to filter file-backed data for policy or authorization, an inverted <=/>= comparison silently returns the wrong rows.", "A flaw was found in DBI::SQL::Nano, a mini-SQL engine for Perl. This vulnerability occurs because the engine incorrectly evaluates SQL operators for text comparisons, specifically inverting the logic for \"less than or equal to\" and \"greater than or equal to\" operations. This can lead to applications that rely on these comparisons for filtering data, such as for policy or authorization, silently returning incorrect results. The impact of this flaw depends on how an application uses these SQL queries."], "name": "CVE-2026-15043", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "perl-DBI", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "perl-DBI", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "perl-DBI", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "perl-DBI", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "perl-DBI:1.641/perl-DBI", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "perl-DBI", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-07-14T09:44:25Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-15043\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-15043\nhttps://github.com/perl5-dbi/dbi/commit/e9742ef85a75867cbd696860e3bf3e32b681f98d.patch\nhttps://github.com/perl5-dbi/dbi/security/advisories/GHSA-mv45-ff6j-x9jp"], "statement": "A Moderate impact flaw in perl-DBI's SQL::Nano engine can lead to incorrect data filtering. This issue arises when applications use file-backed drivers with SQL::Nano as the fallback SQL engine, causing text comparison operators (`<=` and `>=`) to be inverted. This could result in applications silently returning incorrect data, potentially affecting policy enforcement or authorization decisions.", "threat_severity": "Moderate"}