/ 
DBI-1.650
⭐ Starred 84 / DBD::Mem
Security Advisories (4)
CVE-2026-15043 (2026-07-14)

DBI::SQL::Nano versions from 1.42 before 1.651 for Perl have inverted <= and >= SQL operators on text. DBI::SQL::Nano, DBI's built-in mini-SQL engine, evaluated WHERE predicates incorrectly in some cases. In the non-numeric string branch of the is_matched method, <= was evaluated using Perl's ge operator, and >= was evaluated using Perl's le operator. SQL::Nano is the fallback query engine for DBI's file-backed drivers (DBD::File, DBD::DBM, CSV-style drivers) whenever SQL::Statement is not installed, and is forced whenever DBI_SQL_NANO=1. Queries over such tables use these predicates directly. The impact depends on the context. Where an application relies on a WHERE clause to filter file-backed data for policy or authorization, an inverted <=/>= comparison silently returns the wrong rows.

CVE-2026-15392 (2026-07-14)

DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrusted location. The complete_table_name method builds the absolute table file path without checking whether the file is a symbolic link. A link inside the data directory can point to a table file at any path outside of the configured f_dir and f_dir_search directories. Callers of file-based drivers can read or write files outside of the data directory.

CVE-2026-60081 (2026-07-14)

DBI::ProfileData versions before 1.651 for Perl do not limit the path index. The path index column of profile dump files is used to allocate an array of data for the parser. An unbounded value allows an attacker to specify a large index and consume available memory.

CVE-2026-60082 (2026-07-14)

DBI versions before 1.651 for Perl do not enforce statement handle consistency with the row. When the statement handle had no fields but the source row was non-empty, the internal row-buffer helper would read from a negative array index. This could be triggered by a caller supplying inconsistent metadata and rows to the prepare method.

NAME

DBD::Mem - a DBI driver for Mem & MLMem files

SYNOPSIS

use DBI;
$dbh = DBI->connect('dbi:Mem:', undef, undef, {});
$dbh = DBI->connect('dbi:Mem:', undef, undef, {RaiseError => 1});

# or
$dbh = DBI->connect('dbi:Mem:');
$dbh = DBI->connect('DBI:Mem(RaiseError=1):');

and other variations on connect() as shown in the DBI docs and <DBI::DBD::SqlEngine metadata|DBI::DBD::SqlEngine/Metadata>.

Use standard DBI prepare, execute, fetch, placeholders, etc.

DESCRIPTION

DBD::Mem is a database management system that works right out of the box. If you have a standard installation of Perl and DBI you can begin creating, accessing, and modifying simple database tables without any further modules. You can add other modules (e.g., SQL::Statement) for improved functionality.

DBD::Mem doesn't store any data persistently - all data has the lifetime of the instantiated $dbh. The main reason to use DBD::Mem is to use extended features of SQL::Statement where temporary tables are required. One can use DBD::Mem to simulate VIEWS or sub-queries.

Bundling DBD::Mem with DBI will allow us further compatibility checks of DBI::DBD::SqlEngine beyond the capabilities of DBD::File and DBD::DBM. This will ensure DBI provided basis for drivers like DBD::AnyData2 or DBD::Amazon are better prepared and tested for not-file based backends.

Metadata

There're no new meta data introduced by DBD::Mem. See "Metadata" in DBI::DBD::SqlEngine for full description.

GETTING HELP, MAKING SUGGESTIONS, AND REPORTING BUGS

If you need help installing or using DBD::Mem, please write to the DBI users mailing list at mailto:dbi-users@perl.org or to the comp.lang.perl.modules newsgroup on usenet. I cannot always answer every question quickly but there are many on the mailing list or in the newsgroup who can.

DBD developers for DBD's which rely on DBI::DBD::SqlEngine or DBD::Mem or use one of them as an example are suggested to join the DBI developers mailing list at mailto:dbi-dev@perl.org and strongly encouraged to join our IRC channel at irc://irc.perl.org/dbi.

If you have suggestions, ideas for improvements, or bugs to report, please report a bug as described in DBI. Do not mail any of the authors directly, you might not get an answer.

When reporting bugs, please send the output of $dbh->mem_versions($table) for a table that exhibits the bug and as small a sample as you can make of the code that produces the bug. And of course, patches are welcome, too :-).

If you need enhancements quickly, you can get commercial support as described at http://dbi.perl.org/support/ or you can contact Jens Rehsack at rehsack@cpan.org for commercial support.

AUTHOR AND COPYRIGHT

This module is written by Jens Rehsack < rehsack AT cpan.org >.

Copyright (c) 2016- by Jens Rehsack, all rights reserved.

You may freely distribute and/or modify this module under the terms of either the GNU General Public License (GPL) or the Artistic License, as specified in the Perl README file.

SEE ALSO

DBI for the Database interface of the Perl Programming Language.

SQL::Statement and DBI::SQL::Nano for the available SQL engines.

SQL::Statement::RAM where the implementation is shamelessly stolen from to allow DBI bundled Pure-Perl drivers increase the test coverage.

DBD::SQLite using dbname=:memory: for an incredible fast in-memory database engine.