Critical Security Update for perl-DBI: Addressing Heap Overflow and Code Execution Vulnerabilities
Summary
ALSA-2026:52772: Important: perl-DBI:1.641 security update. Affects perl-DBI versions < 1.641-8.module_el8.10.0+4245+6005333d. Fixed in 1.641-8.module_el8.10.0+4245+6005333d. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The perl-DBI package is a widely used database interface module for the Perl programming language. It provides a consistent and database-independent interface for performing database operations, making it a crucial component for developers working with various database systems. However, recent vulnerabilities have been identified that could compromise the security of applications relying on this package.
Vulnerability Detail
The perl-DBI package is affected by two significant vulnerabilities. The first is a heap overflow issue that occurs when preparsing SQL statements with excessive placeholders, potentially leading to memory corruption and application crashes. The second vulnerability allows for arbitrary code execution via a caller-influenced Profile attribute, which could enable an attacker to execute malicious code within the context of the application. Both vulnerabilities pose serious risks to the integrity and security of applications using perl-DBI.
How To Fix
Minimum fixed version
1.641-8.module_el8.10.0+4245+6005333d
This is the first release that contains the fix.
sudo dnf update perl-DBITip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users are advised to limit the number of placeholders in SQL statements to avoid triggering the heap overflow vulnerability. However, this is not a permanent solution, and updating the package is strongly recommended.
Conclusion
The perl-DBI package has critical vulnerabilities that could lead to severe security risks. It is crucial for users to update to the latest patched version to protect their applications. Implementing temporary workarounds may help, but they are not substitutes for proper updates.
See every vulnerability recorded for perl-DBI →
FAQ
perl-DBI is a database interface module for the Perl programming language that provides a consistent method for database operations across different database systems.
The vulnerabilities include a heap overflow when preparsing SQL statements with excessive placeholders and arbitrary code execution via a caller-influenced Profile attribute.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By using the Vulert playground, you can check if your application is affected without needing to sign up.
If immediate updates are not possible, consider implementing the suggested workaround by limiting the number of placeholders in SQL statements until you can apply the patch.
For more details, refer to the CVE pages associated with the vulnerabilities: CVE-2026-14380 and CVE-2026-14739.
Related vulnerabilities
Recent vulnerabilities recorded for perl-DBI.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
