Critical Security Update for perl-DBI: Addressing Arbitrary Code Execution and Heap Overflow Vulnerabilities
Summary
ALSA-2026:49514: Important: perl-DBI security update. Affects perl-DBI versions < 1.643-26.el10_2.3. Fixed in 1.643-26.el10_2.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
perl-DBI is a widely used database access Application Programming Interface (API) for the Perl programming language. It provides a consistent interface for database interaction, allowing developers to write database-agnostic code. The API is designed to facilitate various database operations while maintaining a standard set of functions and conventions. However, recent vulnerabilities have been identified that could compromise the security of applications utilizing this package.
Vulnerability Detail
The vulnerabilities in perl-DBI stem from two critical issues: 1) Arbitrary code execution via caller-influenced Profile attribute (CVE-2026-14380), which allows attackers to execute arbitrary code by manipulating the profile attribute; and 2) A heap overflow when preparsing SQL statements with excessive placeholders (CVE-2026-14739), which can lead to memory corruption and potential exploitation. These vulnerabilities can have severe implications, including unauthorized access to sensitive data and system compromise.
How To Fix
Minimum fixed version
1.643-26.el10_2.3
This is the first release that contains the fix.
sudo dnf update perl-DBITip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, it is advisable to avoid using the affected features of perl-DBI until the package is updated. Specifically, refrain from using caller-influenced Profile attributes and limit the number of placeholders in SQL statements to prevent heap overflow.
Conclusion
The perl-DBI package has critical vulnerabilities that require immediate attention. By updating to the latest patched version, users can mitigate the risks associated with arbitrary code execution and heap overflow. It is crucial to stay informed about such vulnerabilities and utilize tools like Vulert to monitor your applications for potential threats.
See every vulnerability recorded for perl-DBI →
FAQ
perl-DBI is a database access API for Perl that provides a consistent interface for interacting with various databases.
The main vulnerabilities include arbitrary code execution and heap overflow, which can lead to severe security risks.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, avoid using the vulnerable features and monitor for updates regularly.
More information can be found on the CVE pages for CVE-2026-14380 and CVE-2026-14739, which detail the vulnerabilities and their impacts.
Related vulnerabilities
Recent vulnerabilities recorded for perl-DBI.
