{"id":"AZL-92418","summary":"CVE-2026-15043 affecting package perl-DBI for versions less than 1.651-1","details":"DBI::SQL::Nano versions from 1.42 before 1.651 for Perl have inverted \u003c= and \u003e= SQL operators on text.\n\nDBI::SQL::Nano, DBI's built-in mini-SQL engine, evaluated WHERE predicates incorrectly in some cases. In the non-numeric string branch of the is_matched method, \u003c= was evaluated using Perl's ge operator, and \u003e= was evaluated using Perl's le operator.\n\nSQL::Nano is the fallback query engine for DBI's file-backed drivers (DBD::File, DBD::DBM, CSV-style drivers) whenever SQL::Statement is not installed, and is forced whenever DBI_SQL_NANO=1. Queries over such tables use these predicates directly.\n\nThe impact depends on the context. Where an application relies on a WHERE clause to filter file-backed data for policy or authorization, an inverted \u003c=/\u003e= comparison silently returns the wrong rows.","modified":"2026-08-28T17:48:12.600749073Z","published":"2026-07-14T10:16:31Z","upstream":["CVE-2026-15043"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15043"}],"affected":[{"package":{"name":"perl-DBI","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/perl-DBI"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.651-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-92418.json"}}],"schema_version":"1.9.0"}