new file mode 100644
@@ -0,0 +1,51 @@
+From eaf24226efba1e0628868b236c59d2e23bd6236a Mon Sep 17 00:00:00 2001
+From: "H.Merijn Brand - Tux" <linux@tux.freedom.nl>
+Date: Tue, 11 Aug 2026 15:02:52 +0200
+Subject: [PATCH] Limit statements to 292 Mb in preparse (CVE-2026-73193)
+
+CVE: CVE-2026-73193
+Upstream-Status: Backport [https://github.com/perl5-dbi/dbi/commit/c751ae5a5a6f56c2f8284f37c1f4d43500352ef1]
+
+Backport Changes:
+- Applied the DBI.xs security change without functional edits.
+- Omitted ChangeLog and Changes.pm release notes for DBI 1.652.
+- Omitted the dbixs_rev.h timestamp and revision update, which does
+ not affect the preparse fix.
+
+(cherry picked from commit c751ae5a5a6f56c2f8284f37c1f4d43500352ef1)
+Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
+---
+ DBI.xs | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/DBI.xs b/DBI.xs
+index b2fd892..db8e005 100644
+--- a/DBI.xs
++++ b/DBI.xs
+@@ -4187,6 +4187,7 @@ preparse(SV *dbh, const char *statement, IV ps_return, IV ps_accept, void *foo)
+ we add support for odbc escape sequences.
+ */
+ int idx = 1;
++ int sln;
+
+ char in_quote = '\0';
+ char in_comment = '\0';
+@@ -4210,7 +4211,14 @@ preparse(SV *dbh, const char *statement, IV ps_return, IV ps_accept, void *foo)
+ * using factor 6: :p1 .. :p11106
+ * using factor 7: :p1 .. :p111105
+ * and that count is insane already */
+- new_stmt_sv = newSV(strlen(statement) * 7 + 16);
++ sln = strlen(statement);
++ if (sln > 306783375) { /* x * 7 + 16 would overflow maxint on 32bit ints */
++ char buf[99];
++ sprintf(buf, "preparse statement length exceeds maximum length (306783375).");
++ set_err_char(dbh, imp_xxh, "1", 1, buf, 0, "preparse");
++ return &PL_sv_undef;
++ }
++ new_stmt_sv = newSV(sln * 7 + 16);
+ sv_setpv(new_stmt_sv,"");
+ src = statement;
+ dest = SvPVX(new_stmt_sv);
+--
+2.35.6
+
new file mode 100644
@@ -0,0 +1,38 @@
+From f46355f7578f796ad50e650f371f02864bf39b7b Mon Sep 17 00:00:00 2001
+From: Alexander Bluhm <alexander.bluhm@gmx.net>
+Date: Mon, 17 Aug 2026 13:11:38 +0200
+Subject: [PATCH] Fix integer overflow after strlen().
+
+In preparse() the integer variable sln is used the store the return
+value of strlen(). By that the real length is truncated to 32 bit
+and made signed. This way the overflow check sln > 306783375 can
+be circumvented. Make sln of type STRLEN.
+
+CVE: CVE-2026-73193
+Upstream-Status: Backport [https://github.com/perl5-dbi/dbi/commit/afba6751f2acbc1f55ad55aac9f0b58d4f511308]
+
+Backport Changes:
+- Applied the DBI.xs correction without functional edits.
+
+(cherry picked from commit afba6751f2acbc1f55ad55aac9f0b58d4f511308)
+Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
+---
+ DBI.xs | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/DBI.xs b/DBI.xs
+index db8e005..f5c7c29 100644
+--- a/DBI.xs
++++ b/DBI.xs
+@@ -4187,7 +4187,7 @@ preparse(SV *dbh, const char *statement, IV ps_return, IV ps_accept, void *foo)
+ we add support for odbc escape sequences.
+ */
+ int idx = 1;
+- int sln;
++ STRLEN sln;
+
+ char in_quote = '\0';
+ char in_comment = '\0';
+--
+2.35.6
+
@@ -18,6 +18,8 @@ SRC_URI = "${CPAN_MIRROR}/authors/id/H/HM/HMBRAND/DBI-${PV}.tgz \
file://CVE-2026-73194_p1.patch \
file://CVE-2026-73194_p2.patch \
file://CVE-2026-73194_p3.patch \
+ file://CVE-2026-73193_p1.patch \
+ file://CVE-2026-73193_p2.patch \
"
SRC_URI[sha256sum] = "0df16af8e5b3225a68b7b592ab531004ddb35a9682b50300ce50174ad867d9aa"