DBI versions earlier than 1.656 acquire an exclusive lock on a DBD::DBM table before performing checks that can cause the creation to fail. If the open_data call croaks due to an invalid serializer, missing data file, or failed tie, the lock is never released and the table’s metadata remains cached. Subsequent attempts to open the same table, even by a different database handle or process, block indefinitely, effectively freezing the application or any process that tries to access the table.

Perl DBI libraries earlier than version 1.656, including any deployments that use DBD::DBM for local data storage. The vulnerability is tied to the library’s handling of serializer selection and storage backend configuration via the DSN or connection attributes.

The flaw results in a local denial‑of‑service; an attacker that can trigger a failed open_data operation for a specific table can cause the application or any processes that attempt to open that table to hang. The problem is purely a resource release issue and does not provide code execution or data exfiltration. The CVSS score is 6.5, indicating a moderate impact. The EPSS score indicates a very low exploitation probability (< 1 %). The CVE is not listed in CISA’s Known Exploited Vulnerabilities catalog. The primary attack vector is a local or privileged user manipulating DSN parameters or calling DBI functions that lead to a failed table initialization.