A security notice for DBI for Perl reports that versions before 1.654 incorrectly treat numeric values as strings in the sql_type_cast_svpv function. The record identifies the issue as CVE-2026-88815 and was published on September 28, 2026. The available source excerpt does not state impact, severity, or exploitation conditions, so those details cannot be concluded from it.
Check which DBI version is installed in the organization’s Perl systems and projects, and compare it with the threshold in the notice: 1.654. The source describes versions earlier than that as affected.
If a system uses an affected version, consult the project’s official channels and assess an update to version 1.654 or later. Before changing important systems, follow internal testing and deployment procedures; the supplied notice does not detail a fix beyond the version guidance.
To verify the record and find more context, consult the original notice in the oss-sec mailing-list archive, the CVE entry, and DBI’s official channels. Compare the information, check the date and version, and do not assume impact details that are not documented.