HQC parameter tweaks and Perl DBI heap flaws

Post-quantum parameter work and several Perl module vulnerabilities dominated the security and cryptography traffic. An HQC update drew scrutiny over stability, while two heap out-of-bounds issues hit the DBI interface and a Host header flaw affected a Dancer2 auth plugin.

HQC team proposes minor parameter tweaks

The HQC team posted a small update on the NIST pqc-forum proposing minor parameter changes, citing recent papers on decryption failure rates and attacks. Daniel J. Bernstein and John Mattsson questioned the timing, stability of the parameters, and alignment with NIST FIPS 207. Developers following post-quantum standardization have a stake in whether late adjustments remain limited and well justified.

Heap out-of-bounds write in Perl DBI via numeric placeholders

An oss-security disclosure announced CVE-2026-73194 in DBI versions before 1.652 for Perl. An unvalidated numeric placeholder can set the binder counter inside preparse and produce a heap out-of-bounds write. Anyone maintaining Perl services that rely on DBI should treat the fix in 1.652 as relevant to memory safety.

Integer wraparound OOB write on 32-bit Perl DBI

CVE-2026-73193 was reported for the same DBI versions before 1.652, limited to 32-bit Perl builds. An integer wraparound in the output buffer size computed by preparse yields a heap out-of-bounds write. The flaw matters for remaining 32-bit deployments that still use this widely adopted database interface.

Host header poisoning in Dancer2 auth password resets

CVE-2026-15689 covers Dancer2::Plugin::Auth::Extensible versions through 0.713 for Perl. The default password-reset and welcome email paths can be poisoned through the request Host header, allowing crafted reset links. Operators of Dancer2 applications that send authentication mail should review how those helpers construct URLs.