CVE-2026-108518: fallo de gravedad baja en DBI
DBI versions before 1.656 for Perl crash via type confusion in dbi_profile when a database handle is destroyed under a Profile Path with an {attr} element
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
8Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 2.9epss 0.3%
DBI versions before 1.656 for Perl crash via type confusion in dbi_profile when a database handle is destroyed under a Profile Path with an {attr} element.
An {attr} element names a database handle attribute, which dbi_profile reads from the handle's inner hash. It expects the inner handle as a reference and dereferences it, but a handle that is being destroyed hands back the inner hash itself, so the dereference yields the hash's bucket array. A type check on that pointer usually fails and the call goes unprofiled. When the memory it addresses passes the check, the attribute lookup dereferences a NULL or invalid pointer and the process dies on SIGSEGV.
The Path is set by the application, by the Profile handle attribute, or by the DBI_PROFILE environment variable, so `DBI_PROFILE={ImplementorClass}` can crash an unmodified program.
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Productos afectados
DBICVEs relacionadas — DBI
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-73193CRITICALDBI versions before 1.652 for Perl allow a heap out-of-bounds write on 32-bit perl via an integer wraparound in the output buffer size computed by preparseEPSS 0.6%CVE-2026-14380HIGHDBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced ProfileEPSS 0.5%CVE-2026-73194CRITICALDBI versions before 1.652 for Perl allow a heap out-of-bounds write via an unvalidated numeric placeholder that sets the binder counter in preparseEPSS 0.5%CVE-2026-78030CRITICALDBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBMEPSS 0.4%CVE-2026-88816HIGHDBI versions before 1.654 for Perl incorrectly treat numeric values as strings in FetchHashKeyNameEPSS 0.4%CVE-2026-111879MEDIUMDBI versions before 1.656 for Perl hang on a later open of a DBD::DBM table because a failed open_data does not release the table's lockEPSS 0.3%