Red Hat Security Advisory: perl-DBI security update
Two security vulnerabilities have been identified in the perl-DBI package used in Red Hat Enterprise Linux 10. The first vulnerability (CVE-2026-14380) allows arbitrary code execution via a caller-influenced Profile attribute. The second vulnerability (CVE-2026-14739) is a heap overflow occurring when preparsing SQL statements with excessive placeholders. Red Hat has released security updates addressing these issues for multiple architectures and variants of Red Hat Enterprise Linux 10.
AI Analysis
Technical Summary
The perl-DBI package, a database access API for Perl, contains two security flaws. CVE-2026-14380 enables arbitrary code execution through manipulation of the Profile attribute influenced by the caller. CVE-2026-14739 involves a heap overflow triggered by SQL statements with an excessive number of placeholders during preparsing. These vulnerabilities affect Red Hat Enterprise Linux 10 across various supported architectures. Red Hat Product Security has issued an important security advisory (RHSA-2026:49514) with updated packages to remediate these issues.
Potential Impact
Successful exploitation of CVE-2026-14380 could allow an attacker to execute arbitrary code in the context of the affected application. CVE-2026-14739 could lead to memory corruption via heap overflow, potentially resulting in application crashes or code execution. Both vulnerabilities pose significant risks to systems running vulnerable versions of perl-DBI on Red Hat Enterprise Linux 10.
Mitigation Recommendations
Red Hat has released updated perl-DBI packages that address these vulnerabilities. Users should apply the security update RHSA-2026:49514 promptly to remediate these issues. Detailed update instructions are available at https://access.redhat.com/articles/11258. No additional mitigations are specified by the vendor advisory. Patch status is confirmed as an official fix provided by Red Hat.
Red Hat Security Advisory: perl-DBI security update
Description
Two security vulnerabilities have been identified in the perl-DBI package used in Red Hat Enterprise Linux 10. The first vulnerability (CVE-2026-14380) allows arbitrary code execution via a caller-influenced Profile attribute. The second vulnerability (CVE-2026-14739) is a heap overflow occurring when preparsing SQL statements with excessive placeholders. Red Hat has released security updates addressing these issues for multiple architectures and variants of Red Hat Enterprise Linux 10.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The perl-DBI package, a database access API for Perl, contains two security flaws. CVE-2026-14380 enables arbitrary code execution through manipulation of the Profile attribute influenced by the caller. CVE-2026-14739 involves a heap overflow triggered by SQL statements with an excessive number of placeholders during preparsing. These vulnerabilities affect Red Hat Enterprise Linux 10 across various supported architectures. Red Hat Product Security has issued an important security advisory (RHSA-2026:49514) with updated packages to remediate these issues.
Potential Impact
Successful exploitation of CVE-2026-14380 could allow an attacker to execute arbitrary code in the context of the affected application. CVE-2026-14739 could lead to memory corruption via heap overflow, potentially resulting in application crashes or code execution. Both vulnerabilities pose significant risks to systems running vulnerable versions of perl-DBI on Red Hat Enterprise Linux 10.
Mitigation Recommendations
Red Hat has released updated perl-DBI packages that address these vulnerabilities. Users should apply the security update RHSA-2026:49514 promptly to remediate these issues. Detailed update instructions are available at https://access.redhat.com/articles/11258. No additional mitigations are specified by the vendor advisory. Patch status is confirmed as an official fix provided by Red Hat.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:49514
- Cve Count
- 2
- Additional Cves
- ["CVE-2026-14739"]
- Cvss Version
- null
Threat ID: 6a71066dbf32cb7a343953f5
Added to database: 08/03/2026, 21:21:49 UTC
Last enriched: 08/03/2026, 21:35:02 UTC
Last updated: 08/04/2026, 03:17:46 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.