Skip to content
OpenAdvisories
High ELSA-2026-49612 2 CVEs

Important: perl-DBI security update (Oracle Linux 9)

Published Aug 3, 2026 · Updated Aug 3, 2026

Ecosystem: Oracle Linux

Summary

[1.643-9.3]
- Fix unsafe string eval in DBI::Profile (CVE-2026-14380)
- Resolves: RHEL-211149

[1.643-9.2]
- Set a hard limit of 99999 on '?' placeholders (CVE-2026-14739)
- Resolves: RHEL-193306

Fixed packages 1

ReleasePackageFixed in
Oracle Linux · 9 perl-DBI 0:1.643-9.el9_8.3

Vulnerabilities 2

  • Critical 9.8
    CVE-2026-14739

    DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders

    DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders. The fix for CVE-2026-10879 did not allocate enough memory to handle approximately 1.2-million placeholders. DBI version 1.650 sets a…

    HMBRAND DBI libdbi-perl libdbi-perl Debian Ubuntu Azure Linux Alpine
  • High 8.8
    CVE-2026-14380

    DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile

    DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile. When a string is assigned to a DBI handle's Profile attribute, DBI splits it into path, package and arguments, and interpolates the package part in a string eva…

    libdbi-perl libdbi-perl perl-DBI perl-dbi Debian Ubuntu Azure Linux Alpine