Red Hat Security Advisory: perl-DBI security update
Affects Red Hat Product Security Red HatSource GCVE Database
Mentioned vulnerabilities
Not known to be exploited · CVSS 8.8 High.
Data as of 10/25/2026, 09:03:59 UTC
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 27% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
Red Hatredhat/perl-DBIpkg:rpm/redhat/perl-DBIOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Red Hat has released updated perl-DBI packages for Red Hat Enterprise Linux 10 and its variants to address this vulnerability. Users should apply these official updates as described in the Red Hat advisory (https://access.redhat.com/articles/11258) to remediate the issue. Since an official fix is available, applying the update is the recommended mitigation.
Description
DBI is a database access Application Programming Interface (API) for the Perl Language. The DBI API Specification defines a set of functions, variables and conventions that provide a consistent database interface independent of the actual database being used. Security Fix(es): * DBI: Incomplete fix for CVE-2026-14380 DBI: Arbitrary code execution via caller-influenced Profile attribute (CVE-2026-19546) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Impact
The vulnerability allows arbitrary code execution, which can lead to full compromise of affected systems running vulnerable versions of perl-DBI. This can enable attackers to execute malicious code with the privileges of the affected application. The advisory rates the impact as Important, indicating a high risk to affected systems if unpatched.
Summary
The vulnerability CVE-2026-19546 in perl-DBI involves arbitrary code execution through a caller-influenced Profile attribute, representing an incomplete fix of a prior vulnerability CVE-2026-14380. The DBI API provides a consistent database interface for Perl applications. Red Hat has issued an updated perl-DBI package for Red Hat Enterprise Linux 10 to address this issue. The advisory does not include a CVSS score but classifies the security impact as Important. Multiple architectures and update support levels are covered by the update.
Weaknesses
- CWE-94Improper Control of Generation of Code ('Code Injection') (opens in a new tab)
Base weaknessLikelihood of exploit: MediumCWE Top 25 (2025): #10OWASP Top 10 A05:2025: Injection (opens in a new tab)
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
References
- access.redhat.com/errata/RHSA-2026:65887 (opens in a new tab)
- access.redhat.com/security/updates/classification/ (opens in a new tab)
- bugzilla.redhat.com/show_bug.cgi?id=2513963 (opens in a new tab)
- security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_65887.json (opens in a new tab)
- access.redhat.com/errata/RHSA-2026:66179 (opens in a new tab)
- security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_66179.json (opens in a new tab)