CVE-2026-111879 is a vulnerability in the Perl DBI module before version 1.656 where a failure during opening a DBD::DBM table causes the table's lock to remain held indefinitely. This improper locking occurs because a failed open_data call does not release the exclusive lock on the table's lock file, leading to subsequent attempts to open the table blocking indefinitely.
CVE-2026-108518 is a low-severity type confusion vulnerability in Perl's DBI module versions before 1.656. It occurs in the dbi_profile function when a database handle is destroyed under a Profile Path containing an {attr} element. This leads to a crash (SIGSEGV) due to invalid pointer dereferencing during attribute lookup. The vulnerability can be triggered by setting the Profile Path via application code, the Profile handle attribute, or the DBI_PROFILE environment variable.
CVE-2026-88816 is a high-severity vulnerability in Perl's DBI module versions before 1.654. It involves a type confusion issue where numeric values are incorrectly treated as strings in the FetchHashKeyName attribute. This leads to a segmentation fault when fetchrow_hashref attempts to use an invalid pointer as a hash key name. The flaw can be triggered by setting FetchHashKeyName to a numeric value such as an integer or floating-point number.
CVE-2026-88815 is a type confusion vulnerability in Perl's DBI module versions before 1.654. It occurs when numeric values are incorrectly treated as strings during SQL type casting, leading to a segmentation fault. This flaw arises because the function sql_type_cast_svpv passes a string pointer without proper stringification, causing invalid memory access. The vulnerability can be triggered by calling sql_type_cast with a numeric value and SQL_NUMERIC type.
DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM.
DBD::DBM passes the dbm_type and dbm_mldbm connect attributes to require without checking that the value names a module. require treats a path-shaped string as a literal filename and does not consult @INC, so the attribute chooses the file that Perl loads and runs.
The MLDBM::Serializer:: prefix that DBD::DBM prepends to dbm_mldbm is not a boundary: only the :: separators are rewritten to /, so a value containing / traverses out of the serializer directory. The value is also assigned to $MLDBM::Serializer, which MLDBM requires the same way when it ties the table.
A caller that lets an untrusted party influence either attribute, for example through a DSN fragment or a parameter that selects a storage backend, runs the file-scope code of whatever module the value names.
For example,
my $dsn = "dbi:DBM:f_dir=/var/db;dbm_type=../../Untrusted.pm"
my $dbh = DBI->connect( $dsn );
Note that DBD::Gofer forwards connect attributes to the server side, and DBI::ProxyServer checks only that a DSN starts with a driver prefix.
CVE-2026-73193 is a critical integer overflow vulnerability in DBI for Perl versions before 1.652 on 32-bit Perl builds. It allows a heap out-of-bounds write due to an integer wraparound in the output buffer size calculation during statement preprocessing. This can lead to memory corruption when processing very large input statements. 64-bit Perl builds are not affected. The vulnerability has a CVSS score of 9.8, indicating high severity.
DBI versions before 1.652 for Perl allow a heap out-of-bounds write via an unvalidated numeric placeholder that sets the binder counter in preparse.
preparse reserves seven output bytes per input byte, the width of the longest ':p99999' expansion. The ':N' branch parses the number with `atoi(src)` and assigns it to the binder counter with no range check, so a statement containing ':2147483648' leaves the counter negative (-2147483648 with glibc, where atoi wraps). Each following '?' then expands through `sprintf(start, ":p%d", idx++)` to ':p-2147483648', 14 bytes with the terminating NUL where the buffer budgets 7. The placeholder limit added in 1.650 tests the counter against 99,999, which a negative counter passes.
Any caller that preparses an untrusted statement into ':pN' style placeholders gets a heap out-of-bounds write that grows with the number of '?' marks following the poisoned placeholder. The '?' and '%s' return styles compare the parsed number against the expected sequence and error out, and are unaffected.
DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile.
When a string is assigned to a DBI handle's Profile attribute, DBI splits it into path, package and arguments, and interpolates the package part in a string eval with no validation of the package name.
Any caller-influenced value that reaches the Profile attribute is therefore arbitrary Perl code execution, including calls to run system commands.
The Profile attribute can be set from three different sources that can carry untrusted data: the DBI_PROFILE environment variable, a direct attribute assignment, and a DSN driver-attribute clause dbi:Driver(Profile=>SPEC):db.
An attacker controlling any of those inputs runs arbitrary Perl in the host process. The strongest remote position is a network-exposed DBI::Gofer / DBI::ProxyServer whose per-request DSN reaches the Profile attribute, letting a client execute code on the broker host.