Skip to content
OpenAdvisories
High ELSA-2026-49514 2 CVEs

Important: perl-DBI security update (Oracle Linux 10)

Published Aug 3, 2026 · Updated Aug 3, 2026

Ecosystem: Oracle Linux

Summary

[1.643-26.3]
- Fix CVE-2026-14380: unsafe string eval in DBI::Profile
- Resolves: RHEL-211146

[1.643-26.2]
- Fix CVE-2026-14739: set a hard limit of 99999 on '?' placeholders
- Resolves: RHEL-193293

Fixed packages 1

ReleasePackageFixed in
Oracle Linux · 10 perl-DBI 0:1.643-26.el10_2.3

Vulnerabilities 2

  • Critical 9.8
    CVE-2026-14739

    DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders

    DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders. The fix for CVE-2026-10879 did not allocate enough memory to handle approximately 1.2-million placeholders. DBI version 1.650 sets a…

    HMBRAND DBI libdbi-perl libdbi-perl Debian Ubuntu Azure Linux Alpine
  • High 8.8
    CVE-2026-14380

    DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile

    DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile. When a string is assigned to a DBI handle's Profile attribute, DBI splits it into path, package and arguments, and interpolates the package part in a string eva…

    libdbi-perl libdbi-perl perl-DBI perl-dbi Debian Ubuntu Azure Linux Alpine