Critical Security Update for perl-DBI: Addressing Arbitrary Code Execution Vulnerability
Summary
ALSA-2026:66179: Important: perl-DBI security update. Affects perl-DBI versions < 1.643-9.el9_8.5. Fixed in 1.643-9.el9_8.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
perl-DBI is a widely used database access Application Programming Interface (API) for the Perl programming language. It provides a consistent interface for database interactions, allowing developers to write database-agnostic code. The API includes a set of functions, variables, and conventions that facilitate seamless communication with various database systems. However, recent vulnerabilities have been identified that could potentially allow arbitrary code execution, posing significant security risks to applications relying on this package.
Vulnerability Detail
The vulnerability stems from an incomplete fix for CVE-2026-14380, which allows arbitrary code execution through a caller-influenced Profile attribute. This issue can be exploited by attackers to execute malicious code within the context of the application using perl-DBI, leading to unauthorized access and potential data breaches. The vulnerability has been assigned a CVSS score indicating its severity, emphasizing the need for immediate attention and remediation.
How To Fix
Minimum fixed version
1.643-9.el9_8.5
This is the first release that contains the fix.
sudo dnf update perl-DBITip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit the exposure of the affected application by restricting access to the database or implementing strict input validation to mitigate the risk of exploitation until the package is updated.
Conclusion
The perl-DBI package has a critical vulnerability that allows for arbitrary code execution, necessitating immediate action to update to the patched version. Users are encouraged to follow the provided steps for remediation and consider temporary workarounds until the update can be applied.
See every vulnerability recorded for perl-DBI →
FAQ
perl-DBI is a database access API for the Perl programming language, providing a consistent interface for interacting with various database systems.
The vulnerability allows for arbitrary code execution due to an incomplete fix for a previous security issue, which can be exploited by attackers.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, consider implementing strict input validation and limiting database access as temporary workarounds.
For detailed information about the vulnerability, including its impact and related CVEs, refer to the CVE pages linked in the advisory.
Related vulnerabilities
Recent vulnerabilities recorded for perl-DBI.
