Skip to content
OpenAdvisories
High ALSA-2026:62667 4 CVEs

Important: perl-DBI security update

Published Sep 2, 2026 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

DBI is a database access Application Programming Interface (API) for the Perl Language. The DBI API Specification defines a set of functions, variables and conventions that provide a consistent database interface independent of the actual database being used.

Security Fix(es):

* perl-DBI: perl-DBI: Heap overflow in SQL preparsing can lead to denial of service or arbitrary code execution. (CVE-2026-10879)
* DBI: DBI: Buffer overflow in error handling can lead to arbitrary code execution (CVE-2026-9698)
* DBI: DBI: Arbitrary code execution via caller-influenced Profile attribute (CVE-2026-14380)
* DBI: DBI: Heap overflow when preparsing SQL statements with excessive placeholders (CVE-2026-14739)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 1

ReleasePackageFixed in
AlmaLinux · 8 perl-DBI 1.641-2.el8_10

Vulnerabilities 4

  • Critical 9.8
    CVE-2026-10879

    DBI versions before 1.648 for Perl have a heap overflow when preparsing SQL statements with more than 9 binders

    DBI versions before 1.648 for Perl have a heap overflow when preparsing SQL statements with more than 9 binders. The preparse method expands SQL placeholder characters to numbered binders of the form :pN, but only allocates three characters per binder in the …

    HMBRAND DBI libdbi-perl libdbi-perl Debian Ubuntu Azure Linux Alpine
  • Critical 9.8
    CVE-2026-14739

    DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders

    DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders. The fix for CVE-2026-10879 did not allocate enough memory to handle approximately 1.2-million placeholders. DBI version 1.650 sets a…

    HMBRAND DBI libdbi-perl libdbi-perl Debian Ubuntu Azure Linux Alpine
  • High 8.8
    CVE-2026-14380

    DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile

    DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile. When a string is assigned to a DBI handle's Profile attribute, DBI splits it into path, package and arguments, and interpolates the package part in a string eva…

    libdbi-perl libdbi-perl perl-DBI perl-dbi Debian Ubuntu Azure Linux Alpine
  • High 7.5
    CVE-2026-9698

    DBI versions before 1.648 for Perl saved errors in a limited-sized buffer

    DBI versions before 1.648 for Perl saved errors in a limited-sized buffer. Error messages that were returned when RaiseError, PrintError or HandleError were set were written to a 200-byte buffer without a length limit. Attackers that can influence the error t…

    HMBRAND DBI libdbi-perl libdbi-perl Debian Ubuntu Azure Linux Alpine

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-10879
  • report
    https://access.redhat.com/security/cve/CVE-2026-14380
  • report
    https://access.redhat.com/security/cve/CVE-2026-14739
  • report
    https://access.redhat.com/security/cve/CVE-2026-9698
  • report
    https://bugzilla.redhat.com/2485464
  • report
    https://bugzilla.redhat.com/2486734
  • report
    https://bugzilla.redhat.com/2497915
  • report
    https://bugzilla.redhat.com/2497916
  • advisory
    https://errata.almalinux.org/8/ALSA-2026-62667.html