Description
DBI versions before 1.656 for Perl crash via type confusion in dbi_profile when a database handle is destroyed under a Profile Path with an {attr} element.

An {attr} element names a database handle attribute, which dbi_profile reads from the handle's inner hash. It expects the inner handle as a reference and dereferences it, but a handle that is being destroyed hands back the inner hash itself, so the dereference yields the hash's bucket array. A type check on that pointer usually fails and the call goes unprofiled. When the memory it addresses passes the check, the attribute lookup dereferences a NULL or invalid pointer and the process dies on SIGSEGV.

The Path is set by the application, by the Profile handle attribute, or by the DBI_PROFILE environment variable, so `DBI_PROFILE={ImplementorClass}` can crash an unmodified program.
Published: 2026-10-20
Score: 2.9 Low
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service (SIGSEGV).
Action: Immediate Patch
AI Analysis

Impact

A type‑confusion flaw (CWE‑843) in DBI’s dbi_profile occurs when a database handle is destroyed while a Profile Path contains an {attr} element. The profiled code mistakenly reads the handle’s inner hash and dereferences a null or invalid pointer, causing the process to terminate with a segmentation fault. The crash is deterministic once the buggy path is exercised, denying service to the application.

Affected Systems

Perl applications that use the DBI module version 1.655 or lower are affected regardless of the database driver. The flaw can be triggered through the default DBI configuration or by an application that sets a Profile Path via the DBI_PROFILE environment variable or a Profile handle attribute. Any system running these Perl applications is at risk.

Risk and Exploitability

The CVSS score is 2.9 and the EPSS score is < 1%, but the vulnerability is not listed in the CISA KEV catalog. The most likely attack vector is local or uncontrolled configuration: an attacker with the ability to influence the DBI_PROFILE environment variable or the Profile Path setting can cause the targeted process to crash. The impact is a denial of service, and the exploit requires no additional privileges beyond those needed to execute the vulnerable Perl program.

Generated by OpenCVE AI on October 30, 2026 at 14:35 UTC.

Remediation

Vendor Solution

Upgrade to DBI 1.656 or later.

OpenCVE Recommended Actions

  • Upgrade the DBI module to version 1.656 or later.
  • If upgrading immediately is not possible, disable DBI profiling by ensuring the DBI_PROFILE environment variable is unset or set to a safe value and that no application-level Profile Path is configured.
  • Restart all affected Perl services after applying the changes to clear any lingering process state.

Generated by OpenCVE AI on October 30, 2026 at 14:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 30 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}

 cvssV3_1

{'score': 2.9, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L'}

Fri, 23 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
First Time appeared Perl5-dbi
Perl5-dbi dbi
Vendors & Products Perl5-dbi
Perl5-dbi dbi

Wed, 21 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Wed, 21 Oct 2026 01:30:00 +0000

Type Values Removed Values Added
References

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description DBI versions before 1.656 for Perl crash via type confusion in dbi_profile when a database handle is destroyed under a Profile Path with an {attr} element. An {attr} element names a database handle attribute, which dbi_profile reads from the handle's inner hash. It expects the inner handle as a reference and dereferences it, but a handle that is being destroyed hands back the inner hash itself, so the dereference yields the hash's bucket array. A type check on that pointer usually fails and the call goes unprofiled. When the memory it addresses passes the check, the attribute lookup dereferences a NULL or invalid pointer and the process dies on SIGSEGV. The Path is set by the application, by the Profile handle attribute, or by the DBI_PROFILE environment variable, so `DBI_PROFILE={ImplementorClass}` can crash an unmodified program.
Title DBI versions before 1.656 for Perl crash via type confusion in dbi_profile when a database handle is destroyed under a Profile Path with an {attr} element
Weaknesses CWE-843
References

Subscriptions

Perl5-dbi Dbi
cve-icon MITRE

Status: PUBLISHED

Assigner: CPANSec

Published:

Updated: 2026-10-30T12:48:49.541Z

Reserved: 2026-10-10T09:59:45.173Z

Link: CVE-2026-108518

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:18:48.423

Modified: 2026-10-30T13:18:28.023

Link: CVE-2026-108518

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-20T21:23:13Z

Links: CVE-2026-108518 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-30T14:45:14Z

Weaknesses
  • CWE-843

    Access of Resource Using Incompatible Type ('Type Confusion')