Live › vulnerability › CVE-2026-108518
Go to dashboardDBI before 1.656 for Perl mishandles a database handle being destroyed while a Profile Path with an {attr} element is active, so dbi_profile dereferences a hash bucket array as if it were a handle. The result is a SIGSEGV that kills the process, a denial of service; the sources do not describe code execution.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications that use the DBI Perl module below 1.656 and enable profiling with a Profile Path containing an {attr} element, either in code, through the Profile handle attribute, or via the DBI_PROFILE environment variable. Programs that never enable DBI profiling are unlikely to reach the flawed path, and the sources do not say whether default configurations are exposed.
No product ranges from the sources yet.
perl -MDBI -e 'print $DBI::VERSION' and compare the output with 1.656DBI_PROFILE is set in the environment or whether the application sets the Profile attribute with an {attr} element (grep -rn 'Profile' .)1.656 or laterDBI_PROFILE or remove {attr} elements from Profile paths until upgradedEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
DBI versions before 1.656 for Perl crash via type confusion in dbi_profile when a database handle is destroyed under a Profile Path with an {attr} element.
An {attr} element names a database handle attribute, which dbi_profile reads from the handle's inner hash. It expects the inner handle as a reference and dereferences it, but a handle that is being destroyed hands back the inner hash itself, so the dereference yields the hash's bucket array. A type check on that pointer usually fails and the call goes unprofiled. When the memory it addresses passes the check, the attribute lookup dereferences a NULL or invalid pointer and the process dies on SIGSEGV.
The Path is set by the application, by the Profile handle attribute, or by the DBI_PROFILE environment variable, so DBI_PROFILE={ImplementorClass} can crash an unmodified program.
This page as .md · .json · in your agent: get_signal("CVE-2026-108518")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.