new file mode 100644
@@ -0,0 +1,85 @@
+From e5ad87e5602da995d28b4d65df222368b58d6702 Mon Sep 17 00:00:00 2001
+From: "H.Merijn Brand - Tux" <linux@tux.freedom.nl>
+Date: Thu, 10 Sep 2026 10:38:30 +0200
+Subject: [PATCH] Fix DBI::sql_type_cast on IV/NV (reported by Raj)
+
+CVE: CVE-2026-88815
+Upstream-Status: Backport [https://github.com/perl5-dbi/dbi/commit/e5ad87e5602da995d28b4d65df222368b58d6702]
+
+Backport Changes:
+- Add pure IV/NV SQL_NUMERIC regression assertions and adjust the
+ computed test plan to cover the vulnerable conversion path.
+- Omit release notes, generated Changes.pm, and dbixs_rev.h updates.
+
+Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
+---
+ DBI.xs | 4 +++-
+ t/90sql_type_cast.t | 27 +++++++++++++++++++++++++++
+ 2 files changed, 30 insertions(+), 1 deletion(-)
+
+diff --git a/DBI.xs b/DBI.xs
+index f5c7c29..f661db4 100644
+--- a/DBI.xs
++++ b/DBI.xs
+@@ -1985,8 +1985,10 @@ sql_type_cast_svpv(pTHX_ SV *sv, int sql_type, U32 flags, PERL_UNUSED_DECL void
+ /* else no error and sv is untouched */
+ case SQL_NUMERIC:
+ /* based on the code in perl's toke.c */
++ STRLEN len;
++ char *p = SvPV(sv, len); /* force stringify, handle magic */
+ uv = 0;
+- grok_flags = grok_number(SvPVX(sv), SvCUR(sv), &uv);
++ grok_flags = grok_number(p, len, &uv);
+ cast_ok = 1;
+ if (grok_flags == IS_NUMBER_IN_UV) { /* +ve int */
+ if (uv <= IV_MAX) /* prefer IV over UV */
+diff --git a/t/90sql_type_cast.t b/t/90sql_type_cast.t
+index f7b23b6..ca37f65 100644
+--- a/t/90sql_type_cast.t
++++ b/t/90sql_type_cast.t
+@@ -49,6 +49,22 @@ my @tests = (
+ "aa", SQL_NUMERIC, 0, NO_CAST_NO_STRICT, q{["aa"]}],
+ ['non numeric cast to numeric (strict)',
+ "aa", SQL_NUMERIC, DBIstcf_STRICT, NO_CAST_STRICT, q{["aa"]}],
++
++ ['invalid sql type',
++ 99, 123456789, 0, INVALID_TYPE, q{[99]}],
++ ['small int cast to int',
++ 99, SQL_INTEGER, 0, CAST_OK, q{[99]}],
++ ['2 byte max signed int cast to int',
++ 32767, SQL_INTEGER, 0, CAST_OK, q{[32767]}],
++ ['2 byte max unsigned int cast to int',
++ 65535, SQL_INTEGER, 0, CAST_OK, q{[65535]}],
++ ['4 byte max signed int cast to int',
++ 2147483647, SQL_INTEGER, 0, CAST_OK, q{[2147483647]}],
++ ['4 byte max unsigned int cast to int',
++ 4294967295, SQL_INTEGER, 0, CAST_OK, q{[4294967295]}],
++ ['small int cast to int (discard)',
++ 99, SQL_INTEGER, DBIstcf_DISCARD_STRING,
++ CAST_OK, q{[99]}],
+ );
+
+ unless ($pp) {
+@@ -100,6 +116,8 @@ foreach (@tests) {
+ $tests++ if ($dp) && ($_->[2] == SQL_DOUBLE);
+ }
+
++$tests += 2; # Pure IV/NV SQL_NUMERIC regressions.
++
+ plan tests => $tests;
+
+ foreach my $test(@tests) {
+@@ -154,4 +172,13 @@ foreach my $test(@tests) {
+ }
+ }
+
++
++# Exercise SQL_NUMERIC with values that have no string representation.
++my $numeric_iv = 42;
++is(sql_type_cast($numeric_iv, SQL_NUMERIC, 0), CAST_OK,
++ 'pure IV cast to SQL_NUMERIC');
++my $numeric_nv = 3.14;
++is(sql_type_cast($numeric_nv, SQL_NUMERIC, 0), CAST_OK,
++ 'pure NV cast to SQL_NUMERIC');
++
+ 1;
new file mode 100644
@@ -0,0 +1,40 @@
+From ff4f1baf0389dfa5e7282e1d8d7423c1b5e06b76 Mon Sep 17 00:00:00 2001
+From: Paul Howarth <paul@city-fan.org>
+Date: Fri, 25 Sep 2026 13:12:18 +0100
+Subject: [PATCH] Fix compatibility with old compilers not handling C99
+ constructs
+
+Scope-level declarations require a C99 compiler. Move declarations back
+to the start of the function to retain compatibility with older compilers.
+
+CVE: CVE-2026-88815
+Upstream-Status: Backport [https://github.com/perl5-dbi/dbi/commit/ff4f1baf0389dfa5e7282e1d8d7423c1b5e06b76]
+
+Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
+---
+ DBI.xs | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/DBI.xs b/DBI.xs
+index f661db4..c3b2386 100644
+--- a/DBI.xs
++++ b/DBI.xs
+@@ -1953,6 +1953,8 @@ sql_type_cast_svpv(pTHX_ SV *sv, int sql_type, U32 flags, PERL_UNUSED_DECL void
+ int cast_ok = 0;
+ int grok_flags;
+ UV uv;
++ STRLEN len;
++ char *p;
+
+ /* do nothing for undef (NULL) or non-string values */
+ if (!sv || !SvOK(sv))
+@@ -1985,8 +1987,7 @@ sql_type_cast_svpv(pTHX_ SV *sv, int sql_type, U32 flags, PERL_UNUSED_DECL void
+ /* else no error and sv is untouched */
+ case SQL_NUMERIC:
+ /* based on the code in perl's toke.c */
+- STRLEN len;
+- char *p = SvPV(sv, len); /* force stringify, handle magic */
++ p = SvPV(sv, len); /* force stringify, handle magic */
+ uv = 0;
+ grok_flags = grok_number(p, len, &uv);
+ cast_ok = 1;
@@ -22,6 +22,8 @@ SRC_URI = "${CPAN_MIRROR}/authors/id/H/HM/HMBRAND/DBI-${PV}.tgz \
file://CVE-2026-73193_p2.patch \
file://CVE-2026-78030.patch \
file://CVE-2026-111879.patch \
+ file://CVE-2026-88815_p1.patch \
+ file://CVE-2026-88815_p2.patch \
"
SRC_URI[sha256sum] = "0df16af8e5b3225a68b7b592ab531004ddb35a9682b50300ce50174ad867d9aa"