CVE-2026-73193

This is a case where a security boundary creates overconfidence in paths it doesn't actually govern. The DBI placeholder limit of 99,999 performs semantic work it doesn't actually deliver — it advertises parameterized queries as a security feature and the placeholder count reinforces a mental model of bounded input. But the integer overflow occurs at roughly 613 MB of plain text with no placeholder involved at all. A developer who believes 'I'm protected by the placeholder limit' or 'I'm safe because I'm using parameters, not raw SQL' has been misled by the constraint architecture. The documented constraint governs placeholders; the actual constraint is 32-bit STRLEN overflow in allocation math. These are semantically unrelated bounds that happen to occupy the same API surface — a category error that makes the invisible path even more invisible. The practical attack surface centers on what calls DBI's prepare on 32-bit Perl. Any code that prepares SQL statements from untrusted sources is vulnerable. The question isn't whether an attacker can inject ':p99999' sequences — it's whether they can send a 600+ MB payload to any SQL preparation routine running on a 32-bit Perl interpreter. This is plausible in file ingestion, ETL pipelines, log processing, or any application that accepts bulk SQL input. Downstream remediations will inherit the same semantic confusion. A developer who reads 'heap OOB write in preparse via 613 MB input' will add a length check calibrated against what they believe the vulnerability is — a placeholder-related memory issue — not against the actual trigger, which is 32-bit STRLEN arithmetic on any content of sufficient length. The visible guardrail obscures the invisible constraint, and that deception propagates into every downstream mitigation attempt. The EPSS score of 0.00199 likely reflects assumptions about 32-bit Perl rarity in production, but embedded systems, certain Docker base images, and IoT deployments may run this configuration disproportionately. Additionally, the severity score masks invisible remediation complexity — for 32-bit Perl deployments, the fix may require migrating to 64-bit Perl rather than a simple library upgrade. A CVSS 9.8 that never gets patched is more dangerous than a CVSS 9.8 that gets patched in 72 hours, because the former creates a persistent entry in attacker playbooks.

Reviewed through automated stages and approved by a human before publication.