{"id":"CVE-2026-108518","aliases":["AZL-110058","BELL-CVE-2026-108518","DEBIAN-CVE-2026-108518","EUVD-2026-106230","GHSA-7393-6f8r-fhh3","MGASA-2026-0551","OESA-2026-4597","OESA-2026-4598","OESA-2026-4599","OESA-2026-4600","UBUNTU-CVE-2026-108518","openSUSE-SU-2026:12201-1"],"status":"published","title":"DBI versions before 1.656 for Perl crash via type confusion in dbi_profile when a database handle is destroyed under a Profile Path with an {attr} element","description":"DBI versions before 1.656 for Perl crash via type confusion in dbi_profile when a database handle is destroyed under a Profile Path with an {attr} element.\n\nAn {attr} element names a database handle attribute, which dbi_profile reads from the handle's inner hash. It expects the inner handle as a reference and dereferences it, but a handle that is being destroyed hands back the inner hash itself, so the dereference yields the hash's bucket array. A type check on that pointer usually fails and the call goes unprofiled. When the memory it addresses passes the check, the attribute lookup dereferences a NULL or invalid pointer and the process dies on SIGSEGV.\n\nThe Path is set by the application, by the Profile handle attribute, or by the DBI_PROFILE environment variable, so `DBI_PROFILE={ImplementorClass}` can crash an unmodified program.","severity":{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00254,"percentile":0.17099,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-843"],"published":"2026-10-20T00:00:00Z","modified":"2026-11-11T07:30:03Z","fixes":[{"ecosystem":"Azure Linux:3","package":"perl-DBI","fixed_in":["1.656-1"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"perl-dbi","fixed_in":["1.656-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"perl-dbi","fixed_in":["1.656-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"perl-dbi","fixed_in":["1.656-r0"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libdbi-perl","fixed_in":["1.656-1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"perl-DBI","fixed_in":["1.643-13.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"perl-DBI","fixed_in":["1.643-13.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP4","package":"perl-DBI","fixed_in":["1.648-9.oe2403sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"perl-DBI","fixed_in":["1.643-13.oe2203sp4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.656-1"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"perl-dbi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.643-r4"},{"fixed":"1.656-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"perl-dbi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.647-r0"},{"fixed":"1.656-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"perl-dbi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.643-r3"},{"fixed":"1.656-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.643-4","1.643-4+deb12u1","1.643-4+deb12u2","1.643-4+deb12u3","1.644-1","1.645-1","1.647-1","1.648-1","1.649-1","1.650-1","1.651-1","1.652-1","1.652-2","1.652-2~deb13u1","1.653-1","1.654-1","1.655-1","1.656-1"]},{"source":"osv","ecosystem":"Debian:13","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.647-1","1.647-1+deb13u1","1.648-1","1.649-1","1.650-1","1.651-1","1.652-1","1.652-2","1.652-2~deb13u1","1.653-1","1.654-1","1.655-1","1.656-1"]},{"source":"osv","ecosystem":"Debian:14","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.656-1"}]}],"versions":["1.647-1","1.648-1","1.649-1","1.650-1","1.651-1","1.652-1","1.652-2","1.652-2~deb13u1","1.653-1","1.654-1","1.655-1"]},{"source":"osv","ecosystem":"Mageia:10","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.656.0-1.mga10"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.643-13.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.643-13.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.648-9.oe2403sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.643-13.oe2203sp4"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.627-1","1.628-1","1.630-1","1.630-1ubuntu0.1~esm1","1.630-1ubuntu0.1~esm4","1.630-1ubuntu0.1~esm5","1.630-1ubuntu0.1~esm6","1.630-1ubuntu0.1~esm8","1.630-1ubuntu0.1~esm9"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.633-1","1.634-1","1.634-1build1","1.634-1ubuntu0.1","1.634-1ubuntu0.2","1.634-1ubuntu0.2+esm1","1.634-1ubuntu0.2+esm2","1.634-1ubuntu0.2+esm4","1.634-1ubuntu0.2+esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.637-1","1.639-1","1.640-1","1.640-1ubuntu0.1","1.640-1ubuntu0.2","1.640-1ubuntu0.3","1.640-1ubuntu0.3+esm1","1.640-1ubuntu0.3+esm3","1.640-1ubuntu0.3+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.642-1","1.642-1build1","1.643-1","1.643-1ubuntu0.1","1.643-1ubuntu0.1+esm1","1.643-1ubuntu0.1+esm3","1.643-1ubuntu0.1+esm4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.643-3build2","1.643-3build3","1.643-3ubuntu0.1","1.643-3ubuntu0.3","1.643-3ubuntu0.4"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.643-4","1.643-4build1","1.643-4build2","1.643-4build3","1.643-4ubuntu0.1","1.643-4ubuntu0.3","1.643-4ubuntu0.4"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.647-1build1","1.648-1","1.651-1","1.652-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.647-1","1.647-1build1","1.647-1ubuntu0.26.04.1","1.647-1ubuntu0.26.04.3","1.647-1ubuntu0.26.04.4"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.656.0-1.1"}]}],"bundled":2}],"references":[{"url":"https://github.com/perl5-dbi/dbi/security/advisories/GHSA-7393-6f8r-fhh3","tags":["vendor-advisory","exploit","advisory"]},{"url":"https://github.com/perl5-dbi/dbi/commit/c2ff4df575d7af625bb4d0d1ef7539f90b22d8b2.patch","tags":["patch","fix"]},{"url":"https://metacpan.org/release/HMBRAND/DBI-1.656/changes","tags":["release-notes","advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/20/37","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108518","tags":["web","advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-108518","tags":["advisory"]},{"url":"https://cpan.org/modules","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108518.json","tags":["advisory"]},{"url":"https://github.com/perl5-dbi/dbi","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-108518","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0551.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36556","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/10/20/37","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/10/20/38","tags":["web"]},{"url":"https://github.com/perl5-dbi/dbi/security/advisories/GHSA-8cx8-9vj9-9x7j","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4597","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4598","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4599","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4600","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-108518","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-108518","tags":["report"]},{"url":"https://lists.security.metacpan.org/cve-announce/msg/44513047/","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-108518","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-111879","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-108518","title":"DBI versions before 1.656 for Perl crash via type confusion in dbi_profile when a database handle is destroyed under a Profile Path with an {attr} element","description":"DBI versions before 1.656 for Perl crash via type confusion in dbi_profile when a database handle is destroyed under a Profile Path with an {attr} element.\n\nAn {attr} element names a database handle attribute, which dbi_profile reads from the handle's inner hash. It expects the inner handle as a reference and dereferences it, but a handle that is being destroyed hands back the inner hash itself, so the dereference yields the hash's bucket array. A type check on that pointer usually fails and the call goes unprofiled. When the memory it addresses passes the check, the attribute lookup dereferences a NULL or invalid pointer and the process dies on SIGSEGV.\n\nThe Path is set by the application, by the Profile handle attribute, or by the DBI_PROFILE environment variable, so `DBI_PROFILE={ImplementorClass}` can crash an unmodified program.","status":"published","published":"2026-10-20T21:23:13.373Z","modified":"2026-10-30T12:48:49.541Z","cvss":[{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"adp"}],"cwes":["CWE-843"],"updated_at":"2026-11-02T14:20:10.510075Z"}],"euvd":[{"id":"EUVD-2026-106230","description":"DBI versions before 1.656 for Perl crash via type confusion in dbi_profile when a database handle is destroyed under a Profile Path with an {attr} element.\n\nAn {attr} element names a database handle attribute, which dbi_profile reads from the handle's inner hash. It expects the inner handle as a reference and dereferences it, but a handle that is being destroyed hands back the inner hash itself, so the dereference yields the hash's bucket array. A type check on that pointer usually fails and the call goes unprofiled. When the memory it addresses passes the check, the attribute lookup dereferences a NULL or invalid pointer and the process dies on SIGSEGV.\n\nThe Path is set by the application, by the Profile handle attribute, or by the DBI_PROFILE environment variable, so `DBI_PROFILE={ImplementorClass}` can crash an unmodified program.","status":"published","published":"2026-10-20T21:23:13Z","modified":"2026-10-30T12:48:49Z","cvss":[{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T16:59:07.157674Z"}],"nvd":[{"id":"CVE-2026-108518","description":"DBI versions before 1.656 for Perl crash via type confusion in dbi_profile when a database handle is destroyed under a Profile Path with an {attr} element.\n\nAn {attr} element names a database handle attribute, which dbi_profile reads from the handle's inner hash. It expects the inner handle as a reference and dereferences it, but a handle that is being destroyed hands back the inner hash itself, so the dereference yields the hash's bucket array. A type check on that pointer usually fails and the call goes unprofiled. When the memory it addresses passes the check, the attribute lookup dereferences a NULL or invalid pointer and the process dies on SIGSEGV.\n\nThe Path is set by the application, by the Profile handle attribute, or by the DBI_PROFILE environment variable, so `DBI_PROFILE={ImplementorClass}` can crash an unmodified program.","status":"published","published":"2026-10-20T22:18:48.423Z","modified":"2026-10-30T13:18:28.023Z","cvss":[{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"secondary"}],"cwes":["CWE-843"],"updated_at":"2026-11-02T14:13:01.463896Z"}],"osv":[{"id":"BELL-CVE-2026-108518","status":"published","published":"2026-10-22T06:11:58.137103Z","modified":"2026-11-11T07:30:03.537632437Z","cvss":[{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-11T07:56:34.161951Z"},{"id":"CVE-2026-108518","title":"DBI versions before 1.656 for Perl crash via type confusion in dbi_profile when a database handle is destroyed under a Profile Path with an {attr} element","description":"DBI versions before 1.656 for Perl crash via type confusion in dbi_profile when a database handle is destroyed under a Profile Path with an {attr} element.\n\nAn {attr} element names a database handle attribute, which dbi_profile reads from the handle's inner hash. It expects the inner handle as a reference and dereferences it, but a handle that is being destroyed hands back the inner hash itself, so the dereference yields the hash's bucket array. A type check on that pointer usually fails and the call goes unprofiled. When the memory it addresses passes the check, the attribute lookup dereferences a NULL or invalid pointer and the process dies on SIGSEGV.\n\nThe Path is set by the application, by the Profile handle attribute, or by the DBI_PROFILE environment variable, so `DBI_PROFILE={ImplementorClass}` can crash an unmodified program.","status":"published","published":"2026-10-20T21:23:13.373Z","modified":"2026-11-01T02:30:33.994879912Z","cvss":[{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"cwes":["CWE-843"],"updated_at":"2026-11-02T15:44:54.933106Z"},{"id":"DEBIAN-CVE-2026-108518","description":"DBI versions before 1.656 for Perl crash via type confusion in dbi_profile when a database handle is destroyed under a Profile Path with an {attr} element.  An {attr} element names a database handle attribute, which dbi_profile reads from the handle's inner hash. It expects the inner handle as a reference and dereferences it, but a handle that is being destroyed hands back the inner hash itself, so the dereference yields the hash's bucket array. A type check on that pointer usually fails and the call goes unprofiled. When the memory it addresses passes the check, the attribute lookup dereferences a NULL or invalid pointer and the process dies on SIGSEGV.  The Path is set by the application, by the Profile handle attribute, or by the DBI_PROFILE environment variable, so `DBI_PROFILE={ImplementorClass}` can crash an unmodified program.","status":"published","published":"2026-10-20T22:18:48.423Z","modified":"2026-10-31T10:01:10.939584728Z","cvss":[{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:45:49.381767Z"},{"id":"OESA-2026-4597","title":"perl-DBI security update","description":"The DBI is the standard database interface module for Perl. It defines a set of methods, variables and conventions that provide a consistent database interface independent of the actual database being used. It is important to remember that the DBI is just an interface. The DBI is a layer of \u0026amp;quot;glue\u0026amp;quot; between an application and one or more database driver modules. It is the driver modules which do most of the real work. The DBI provides a standard interface and framework for the drivers to operate within.\r\n\r\nSecurity Fix(es):\n\nDBI versions before 1.656 for Perl crash via type confusion in dbi_profile when a database handle is destroyed under a Profile Path with an {attr} element.\n\nAn {attr} element names a database handle attribute, which dbi_profile reads from the handle\u0026apos;s inner hash. It expects the inner handle as a reference and dereferences it, but a handle that is being destroyed hands back the inner hash itself, so the dereference yields the hash\u0026apos;s bucket array. A type check on that pointer usually fails and the call goes unprofiled. When the memory it addresses passes the check, the attribute lookup dereferences a NULL or invalid pointer and the process dies on SIGSEGV.\n\nThe Path is set by the application, by the Profile handle attribute, or by the DBI_PROFILE environment variable, so `DBI_PROFILE={ImplementorClass}` can crash an unmodified program.(CVE-2026-108518)","status":"published","published":"2026-10-29T09:03:24Z","modified":"2026-10-29T09:15:38.583665111Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:47.981622Z"},{"id":"OESA-2026-4598","title":"perl-DBI security update","description":"The DBI is the standard database interface module for Perl. It defines a set of methods, variables and conventions that provide a consistent database interface independent of the actual database being used. It is important to remember that the DBI is just an interface. The DBI is a layer of \u0026amp;quot;glue\u0026amp;quot; between an application and one or more database driver modules. It is the driver modules which do most of the real work. The DBI provides a standard interface and framework for the drivers to operate within.\r\n\r\nSecurity Fix(es):\n\nDBI versions before 1.656 for Perl crash via type confusion in dbi_profile when a database handle is destroyed under a Profile Path with an {attr} element.\n\nAn {attr} element names a database handle attribute, which dbi_profile reads from the handle\u0026apos;s inner hash. It expects the inner handle as a reference and dereferences it, but a handle that is being destroyed hands back the inner hash itself, so the dereference yields the hash\u0026apos;s bucket array. A type check on that pointer usually fails and the call goes unprofiled. When the memory it addresses passes the check, the attribute lookup dereferences a NULL or invalid pointer and the process dies on SIGSEGV.\n\nThe Path is set by the application, by the Profile handle attribute, or by the DBI_PROFILE environment variable, so `DBI_PROFILE={ImplementorClass}` can crash an unmodified program.(CVE-2026-108518)","status":"published","published":"2026-10-29T09:03:24Z","modified":"2026-10-29T09:15:38.580037065Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:47.981622Z"},{"id":"OESA-2026-4599","title":"perl-DBI security update","description":"The DBI is the standard database interface module for Perl. It defines a set of methods, variables and conventions that provide a consistent database interface independent of the actual database being used. It is important to remember that the DBI is just an interface. The DBI is a layer of \u0026amp;quot;glue\u0026amp;quot; between an application and one or more database driver modules. It is the driver modules which do most of the real work. The DBI provides a standard interface and framework for the drivers to operate within.\r\n\r\nSecurity Fix(es):\n\nDBI versions before 1.656 for Perl crash via type confusion in dbi_profile when a database handle is destroyed under a Profile Path with an {attr} element.\n\nAn {attr} element names a database handle attribute, which dbi_profile reads from the handle\u0026apos;s inner hash. It expects the inner handle as a reference and dereferences it, but a handle that is being destroyed hands back the inner hash itself, so the dereference yields the hash\u0026apos;s bucket array. A type check on that pointer usually fails and the call goes unprofiled. When the memory it addresses passes the check, the attribute lookup dereferences a NULL or invalid pointer and the process dies on SIGSEGV.\n\nThe Path is set by the application, by the Profile handle attribute, or by the DBI_PROFILE environment variable, so `DBI_PROFILE={ImplementorClass}` can crash an unmodified program.(CVE-2026-108518)","status":"published","published":"2026-10-29T09:03:25Z","modified":"2026-10-29T09:15:38.580050966Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:47.981622Z"},{"id":"OESA-2026-4600","title":"perl-DBI security update","description":"The DBI is the standard database interface module for Perl. It defines a set of methods, variables and conventions that provide a consistent database interface independent of the actual database being used. It is important to remember that the DBI is just an interface. The DBI is a layer of \u0026amp;quot;glue\u0026amp;quot; between an application and one or more database driver modules. It is the driver modules which do most of the real work. The DBI provides a standard interface and framework for the drivers to operate within.\r\n\r\nSecurity Fix(es):\n\nDBI versions before 1.656 for Perl crash via type confusion in dbi_profile when a database handle is destroyed under a Profile Path with an {attr} element.\n\nAn {attr} element names a database handle attribute, which dbi_profile reads from the handle\u0026apos;s inner hash. It expects the inner handle as a reference and dereferences it, but a handle that is being destroyed hands back the inner hash itself, so the dereference yields the hash\u0026apos;s bucket array. A type check on that pointer usually fails and the call goes unprofiled. When the memory it addresses passes the check, the attribute lookup dereferences a NULL or invalid pointer and the process dies on SIGSEGV.\n\nThe Path is set by the application, by the Profile handle attribute, or by the DBI_PROFILE environment variable, so `DBI_PROFILE={ImplementorClass}` can crash an unmodified program.(CVE-2026-108518)","status":"published","published":"2026-10-29T09:03:26Z","modified":"2026-10-29T09:15:38.585329884Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:47.981622Z"},{"id":"UBUNTU-CVE-2026-108518","description":"DBI versions before 1.656 for Perl crash via type confusion in dbi_profile when a database handle is destroyed under a Profile Path with an {attr} element. An {attr} element names a database handle attribute, which dbi_profile reads from the handle's inner hash. It expects the inner handle as a reference and dereferences it, but a handle that is being destroyed hands back the inner hash itself, so the dereference yields the hash's bucket array. A type check on that pointer usually fails and the call goes unprofiled. When the memory it addresses passes the check, the attribute lookup dereferences a NULL or invalid pointer and the process dies on SIGSEGV. The Path is set by the application, by the Profile handle attribute, or by the DBI_PROFILE environment variable, so `DBI_PROFILE={ImplementorClass}` can crash an unmodified program.","status":"published","published":"2026-10-20T22:18:00Z","modified":"2026-11-03T21:19:14.425260047Z","cvss":[{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-03T21:43:32.336286Z"},{"id":"AZL-110058","title":"CVE-2026-108518 affecting package perl-DBI for versions less than 1.656-1","description":"DBI versions before 1.656 for Perl crash via type confusion in dbi_profile when a database handle is destroyed under a Profile Path with an {attr} element.\n\nAn {attr} element names a database handle attribute, which dbi_profile reads from the handle's inner hash. It expects the inner handle as a reference and dereferences it, but a handle that is being destroyed hands back the inner hash itself, so the dereference yields the hash's bucket array. A type check on that pointer usually fails and the call goes unprofiled. When the memory it addresses passes the check, the attribute lookup dereferences a NULL or invalid pointer and the process dies on SIGSEGV.\n\nThe Path is set by the application, by the Profile handle attribute, or by the DBI_PROFILE environment variable, so `DBI_PROFILE={ImplementorClass}` can crash an unmodified program.","status":"published","published":"2026-10-20T22:18:48Z","modified":"2026-11-02T14:18:15.693104012Z","updated_at":"2026-11-02T15:28:02.044071Z"},{"id":"MGASA-2026-0551","title":"Updated perl-DBI package fixes security vulnerabilities","description":"dbi_profile(): crash (type confusion) when a database handle is\ndestroyed while its Profile Path contains {attr} elements.\n(CVE-2026-108518)\nFailed DBD::DBM file creation left lock files in place.\n(CVE-2026-111879)\n","status":"published","published":"2026-10-27T04:31:25Z","modified":"2026-10-27T04:45:03.134310635Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:12201-1","title":"perl-DBI-1.656.0-1.1 on GA media","description":"These are all security issues fixed in the perl-DBI-1.656.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-20T00:00:00Z","modified":"2026-10-21T17:23:13.857327441Z","updated_at":"2026-11-02T16:58:40.245664Z"}]}}