diff --git a/DBI-1.643-Fix-CVE-2026-9698.patch b/DBI-1.643-Fix-CVE-2026-9698.patch
new file mode 100644
index 0000000..c6218af
--- /dev/null
+++ b/DBI-1.643-Fix-CVE-2026-9698.patch
@@ -0,0 +1,34 @@
+From c86476918f64150ca4bae2f39004aadb1ec6fa23 Mon Sep 17 00:00:00 2001
+From: "H.Merijn Brand - Tux" <linux@tux.freedom.nl>
+Date: Wed, 27 May 2026 11:16:50 +0200
+Subject: [PATCH] Fix possible stack overflow (old issue already noted by Tim)
+
+---
+ DBI.xs | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+diff --git a/DBI.xs b/DBI.xs
+index 2cea4ac..c549d15 100644
+--- a/DBI.xs
++++ b/DBI.xs
+@@ -3998,7 +3998,6 @@ XS(XS_DBI_dispatch)
+         SV **statement_svp = NULL;
+         const int is_warning = (!SvTRUE(err_sv) && strlen(SvPV_nolen(err_sv))==1);
+         const char *err_meth_name = meth_name;
+-        char intro[200];
+ 
+         if (meth_type == methtype_set_err) {
+             SV **sem_svp = hv_fetch((HV*)SvRV(h), "dbi_set_err_method", 18, GV_ADDWARN);
+@@ -4006,10 +4005,8 @@ XS(XS_DBI_dispatch)
+                 err_meth_name = SvPV_nolen(*sem_svp);
+         }
+ 
+-        /* XXX change to vsprintf into sv directly */
+-        sprintf(intro,"%s %s %s: ", HvNAME(DBIc_IMP_STASH(imp_xxh)), err_meth_name,
+-            SvTRUE(err_sv) ? "failed" : is_warning ? "warning" : "information");
+-        msg = sv_2mortal(newSVpv(intro,0));
++        msg = sv_2mortal(newSVpvf("%s %s %s: ", HvNAME(DBIc_IMP_STASH(imp_xxh)), err_meth_name,
++            SvTRUE(err_sv) ? "failed" : is_warning ? "warning" : "information"));
+         if (SvOK(DBIc_ERRSTR(imp_xxh)))
+             sv_catsv(msg, DBIc_ERRSTR(imp_xxh));
+         else
diff --git a/perl-DBI.spec b/perl-DBI.spec
index 90e428e..af1aab0 100644
--- a/perl-DBI.spec
+++ b/perl-DBI.spec
@@ -34,7 +34,7 @@
 
 Name:           perl-DBI
 Version:        1.643
-Release:        26%{?dist}
+Release:        27%{?dist}
 Summary:        A database access API for perl
 License:        GPL-1.0-or-later OR Artistic-1.0-Perl
 URL:            http://dbi.perl.org/
@@ -44,6 +44,8 @@ Patch0:         DBI-1.643-Fix-for-CVE-2014-10401.patch
 Patch1:         DBI-1.643-Fix-for-empty-attributes-in-DSN.patch
 Patch2:         DBI-1.643-Catch-warning.patch
 Patch3:         DBI-1.643-Document-the-new-behavior-for-f_dir.patch
+# RHEL-184982, CVE-2026-9698, Fix possible stack overflow in DBI.xs
+Patch4:         DBI-1.643-Fix-CVE-2026-9698.patch
 BuildRequires:  coreutils
 BuildRequires:  findutils
 BuildRequires:  gcc
@@ -277,6 +279,10 @@ make test
 %{_libexecdir}/%{name}
 
 %changelog
+* Thu Jul 30 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.643-27
+- Fix CVE-2026-9698: stack buffer overflow in DBI.xs
+  Resolves: RHEL-184982
+
 * Tue Oct 29 2024 Troy Dawson <tdawson@redhat.com> - 1.643-26
 - Bump release for October 2024 mass rebuild:
   Resolves: RHEL-64018