The perl-DBI package, a database access API for Perl, contains two vulnerabilities: CVE-2026-14380, which permits arbitrary code execution through manipulation of the Profile attribute by the caller, and CVE-2026-14739, a heap overflow vulnerability caused by preparsing SQL statements with an excessive number of placeholders. Red Hat has issued security updates for Red Hat Enterprise Linux 9 and its Extended Update Support versions to address these vulnerabilities. The advisory references fixes in perl-DBI version 1.643-9.el9_8.3 across multiple supported architectures including x86_64, s390x, ppc64le, and aarch64.

Successful exploitation of CVE-2026-14380 could allow an attacker to execute arbitrary code, potentially leading to full system compromise. CVE-2026-14739 could cause a heap overflow, which might be leveraged to execute arbitrary code or cause denial of service. Both vulnerabilities pose a high security risk as indicated by Red Hat's Important severity rating.

Red Hat has released updated perl-DBI packages (version 1.643-9.el9_8.3) that fix these vulnerabilities. Users of Red Hat Enterprise Linux 9 and its Extended Update Support versions should apply these updates promptly. Detailed update instructions are available in the Red Hat advisory article https://access.redhat.com/articles/11258. No additional mitigations are specified beyond applying the official patches.