Summary
Harsh Raj Singhania discovered that the Perl DBI module did not
correctly validate certain attributes. An attacker could possibly use
this issue to execute arbitrary code. (CVE-2026-78030)
Harsh Raj Singhania discovered that the Perl DBI module did not
correctly handle certain string operations. An attacker could possibly
use this issue to cause a denial of service. (CVE-2026-88816)
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | libdbi-perl | 1.643-3ubuntu0.4 |
| Ubuntu · 24.04 LTS 24.04:LTS | libdbi-perl | 1.643-4ubuntu0.4 |
| Ubuntu · 26.04 LTS 26.04:LTS | libdbi-perl | 1.647-1ubuntu0.26.04.4 |
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | libdbi-perl | 1.630-1ubuntu0.1~esm9 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | libdbi-perl | 1.634-1ubuntu0.2+esm5 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | libdbi-perl | 1.640-1ubuntu0.3+esm4 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | libdbi-perl | 1.643-1ubuntu0.1+esm4 |
Vulnerabilities 2
-
Critical 9.8
DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM
DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM. DBD::DBM passes the dbm_type and dbm_mldbm connect attributes to require without checking that the value names a module. require treats a …
-
High 7.5
DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in FetchHashKeyName
DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in FetchHashKeyName. fetchrow_hashref uses the string pointer of the FetchHashKeyName attribute as the key name without stringifying it first. When FetchHashKeyName has been set to…