DBI::SQL::Nano versions from 1.42 before 1.651 for Perl have inverted <= and >= SQL operators on text.
DBI::SQL::Nano, DBI's built-in mini-SQL engine, evaluated WHERE predicates incorrectly in some cases. In the non-numeric string branch of the is_matched method, <= was evaluated using Perl's ge operator, and >= was evaluated using Perl's le operator.
SQL::Nano is the fallback query engine for DBI's file-backed drivers (DBD::File, DBD::DBM, CSV-style drivers) whenever SQL::Statement is not installed, and is forced whenever DBI_SQL_NANO=1. Queries over such tables use these predicates directly.
The impact depends on the context. Where an application relies on a WHERE clause to filter file-backed data for policy or authorization, an inverted <=/>= comparison silently returns the wrong rows.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade perl-dbi | Jul 28, 2026 | Jul 14, 2026 |
| Amazon Linux Ami 2 | — | Upgrade perl-DBI-debuginfoUpgrade perl-DBI | Aug 5, 2026 | Aug 5, 2026 |
| Amazon_linux_2023 | — | Upgrade perl-DBI-testsUpgrade perl-DBI-debuginfoUpgrade perl-DBI-debugsourceUpgrade perl-DBI | Aug 10, 2026 | Jul 14, 2026 |
| Debian | — | Upgrade libdbi-perl | Aug 30, 2026 | Aug 30, 2026 |
| Redhat_linux | — | No solution exists | Jul 20, 2026 | Jul 14, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub