Summary
The perl-DBI package provides the standard database interface module for the
Perl programming language. It implements a database-independent interface,
meaning it defines a consistent set of methods, variables, and conventions for
database operations.
Security Fix(es):
* DBI: Heap overflow when preparsing SQL statements with excessive placeholders (CVE-2026-14739)
* DBI: Arbitrary code execution via caller-influenced Profile attribute (CVE-2026-14380)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 8 | perl-DBI | 0:1.641-8.module+el8.10.0+40273+66ce089d |
| Rocky Linux · 8 | perl-DBI | 0:1.641-8.module+el8.10.0+40273+4d327a6c |
| Rocky Linux · 8 | perl-DBI | 0:1.641-8.module+el8.10.0+40273+d479100a |
| Rocky Linux · 8 | perl-DBI | 0:1.641-8.module+el8.10.0+40273+0bbde87c |
Vulnerabilities 2
-
Critical 9.8
DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders
DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders. The fix for CVE-2026-10879 did not allocate enough memory to handle approximately 1.2-million placeholders. DBI version 1.650 sets a…
-
High 8.8
DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile
DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile. When a string is assigned to a DBI handle's Profile attribute, DBI splits it into path, package and arguments, and interpolates the package part in a string eva…