Critical Security Flaws in perl-DBI: Arbitrary Code Execution and Heap Overflow
Summary
ALSA-2026:49612: Important: perl-DBI security update. Affects perl-DBI versions < 1.643-9.el9_8.3. Fixed in 1.643-9.el9_8.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
perl-DBI is a widely used database access Application Programming Interface (API) for the Perl programming language. It provides a consistent interface for database interaction, allowing developers to write database-agnostic code. The API specification includes a set of functions and conventions that facilitate seamless communication with various database systems. However, recent vulnerabilities have been identified that could compromise the security of applications utilizing this package.
Vulnerability Detail
The vulnerabilities in perl-DBI include arbitrary code execution and a heap overflow. The arbitrary code execution vulnerability arises from a caller-influenced Profile attribute, which could allow an attacker to execute arbitrary code within the context of the application. The heap overflow vulnerability occurs when SQL statements with excessive placeholders are pre-parsed, potentially leading to memory corruption and application crashes. Both vulnerabilities pose significant risks to the integrity and security of applications relying on perl-DBI.
How To Fix
Minimum fixed version
1.643-9.el9_8.3
This is the first release that contains the fix.
sudo dnf update perl-DBITip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider limiting the use of dynamic SQL statements with excessive placeholders and avoid using the Profile attribute in a way that could be influenced by untrusted sources. This may help mitigate the risks until the package can be updated.
Conclusion
The vulnerabilities in perl-DBI present serious security risks that can lead to arbitrary code execution and memory corruption. It is crucial for users of this package to update to the latest patched version to safeguard their applications. Implementing workarounds can provide temporary relief until the update is applied.
See every vulnerability recorded for perl-DBI →
FAQ
perl-DBI is a database access API for the Perl programming language, providing a standardized way to interact with various databases.
The main vulnerabilities include arbitrary code execution via a caller-influenced Profile attribute and a heap overflow when preparsing SQL statements with excessive placeholders.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. Visit Vulert Scanner to check your application without needing to sign up.
If an immediate update is not possible, implement workarounds such as limiting dynamic SQL statements and avoiding risky Profile attribute usage.
For more details, refer to the CVE pages linked in the vulnerability report, which provide comprehensive information about the issues and their impacts.
Related vulnerabilities
Recent vulnerabilities recorded for perl-DBI.
