{"id":"CVE-2026-78030","aliases":["AZL-103475","BELL-CVE-2026-78030","DEBIAN-CVE-2026-78030","EUVD-2026-83584","GHSA-wqmw-wqwx-3fr7","MGASA-2026-0486","OESA-2026-4186","OESA-2026-4187","OESA-2026-4188","OESA-2026-4189","ROOT-OS-DEBIAN-12-CVE-2026-78030","SUSE-SU-2026:23919-1","SUSE-SU-2026:23952-1","SUSE-SU-2026:4346-1","SUSE-SU-2026:4386-1","SUSE-SU-2026:4612-1","UBUNTU-CVE-2026-78030","USN-8912-1","openSUSE-SU-2026:11754-1","openSUSE-SU-2026:21960-1"],"status":"published","title":"DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM","description":"DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM.\n\nDBD::DBM passes the dbm_type and dbm_mldbm connect attributes to require without checking that the value names a module. require treats a path-shaped string as a literal filename and does not consult @INC, so the attribute chooses the file that Perl loads and runs.\n\nThe MLDBM::Serializer:: prefix that DBD::DBM prepends to dbm_mldbm is not a boundary: only the :: separators are rewritten to /, so a value containing / traverses out of the serializer directory. The value is also assigned to $MLDBM::Serializer, which MLDBM requires the same way when it ties the table.\n\nA caller that lets an untrusted party influence either attribute, for example through a DSN fragment or a parameter that selects a storage backend, runs the file-scope code of whatever module the value names.\n\nFor example,\n\n    my $dsn = \"dbi:DBM:f_dir=/var/db;dbm_type=../../Untrusted.pm\"\n    my $dbh = DBI-\u003econnect( $dsn );\n\nNote that DBD::Gofer forwards connect attributes to the server side, and DBI::ProxyServer checks only that a DSN starts with a driver prefix.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00424,"percentile":0.36952,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-470"],"published":"2026-09-11T00:00:00Z","modified":"2026-11-02T14:15:41Z","fixes":[{"ecosystem":"Azure Linux:3","package":"perl-DBI","fixed_in":["1.655-1"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"perl-dbi","fixed_in":["1.654-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"perl-dbi","fixed_in":["1.654-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"perl-dbi","fixed_in":["1.654-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libdbi-perl","fixed_in":["1.643-4+deb12u3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libdbi-perl","fixed_in":["1.653-1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"perl-DBI","fixed_in":["1.643-10.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP4","package":"perl-DBI","fixed_in":["1.648-6.oe2403sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"perl-DBI","fixed_in":["1.643-10.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"perl-DBI","fixed_in":["1.643-10.oe2403sp1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"perl-DBI","fixed_in":["1.647.0-160000.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"perl-DBI","fixed_in":["1.647.0-160000.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.2","package":"perl-DBI","fixed_in":["1.647.0-160000.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"perl-DBI","fixed_in":["1.628-5.24.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"perl-DBI","fixed_in":["1.628-5.24.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"perl-DBI","fixed_in":["1.647.0-150600.12.21.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"perl-DBI","fixed_in":["1.647.0-150600.12.21.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"perl-DBI","fixed_in":["1.647.0-150600.12.21.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libdbi-perl","fixed_in":["1.630-1ubuntu0.1~esm9"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libdbi-perl","fixed_in":["1.634-1ubuntu0.2+esm5"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libdbi-perl","fixed_in":["1.640-1ubuntu0.3+esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libdbi-perl","fixed_in":["1.643-1ubuntu0.1+esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"libdbi-perl","fixed_in":["1.643-3ubuntu0.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"libdbi-perl","fixed_in":["1.643-4ubuntu0.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"libdbi-perl","fixed_in":["1.647-1ubuntu0.26.04.4"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"perl-DBI","fixed_in":["1.647.0-160000.6.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.655-1"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"perl-dbi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.643-r4"},{"fixed":"1.654-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"perl-dbi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.647-r0"},{"fixed":"1.654-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"perl-dbi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.643-r3"},{"fixed":"1.654-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.643-4+deb12u3"}]}],"versions":["1.643-4","1.643-4+deb12u1","1.643-4+deb12u2"]},{"source":"osv","ecosystem":"Debian:13","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.647-1","1.647-1+deb13u1","1.648-1","1.649-1","1.650-1","1.651-1","1.652-1","1.652-2","1.652-2~deb13u1","1.653-1","1.654-1"]},{"source":"osv","ecosystem":"Debian:14","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.653-1"}]}],"versions":["1.647-1","1.648-1","1.649-1","1.650-1","1.651-1","1.652-1","1.652-2","1.652-2~deb13u1"]},{"source":"osv","ecosystem":"Mageia:10","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.655.0-1.mga10"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.643-10.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.648-6.oe2403sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.643-10.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.643-10.oe2403sp1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.647.0-160000.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.647.0-160000.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.647.0-160000.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.628-5.24.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.628-5.24.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.647.0-150600.12.21.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.647.0-150600.12.21.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.647.0-150600.12.21.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.642-150200.3.26.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.642-150200.3.26.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.642-150200.3.26.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.642-150200.3.26.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.642-150200.3.26.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.642-150200.3.26.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.642-150200.3.26.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.642-150200.3.26.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.630-1ubuntu0.1~esm9"}]}],"versions":["1.627-1","1.628-1","1.630-1","1.630-1ubuntu0.1~esm1","1.630-1ubuntu0.1~esm4","1.630-1ubuntu0.1~esm5","1.630-1ubuntu0.1~esm6","1.630-1ubuntu0.1~esm8"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.634-1ubuntu0.2+esm5"}]}],"versions":["1.633-1","1.634-1","1.634-1build1","1.634-1ubuntu0.1","1.634-1ubuntu0.2","1.634-1ubuntu0.2+esm1","1.634-1ubuntu0.2+esm2","1.634-1ubuntu0.2+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.640-1ubuntu0.3+esm4"}]}],"versions":["1.637-1","1.639-1","1.640-1","1.640-1ubuntu0.1","1.640-1ubuntu0.2","1.640-1ubuntu0.3","1.640-1ubuntu0.3+esm1","1.640-1ubuntu0.3+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.643-1ubuntu0.1+esm4"}]}],"versions":["1.642-1","1.642-1build1","1.643-1","1.643-1ubuntu0.1","1.643-1ubuntu0.1+esm1","1.643-1ubuntu0.1+esm3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.643-3ubuntu0.4"}]}],"versions":["1.643-3build2","1.643-3build3","1.643-3ubuntu0.1","1.643-3ubuntu0.3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.643-4ubuntu0.4"}]}],"versions":["1.643-4","1.643-4build1","1.643-4build2","1.643-4build3","1.643-4ubuntu0.1","1.643-4ubuntu0.3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.647-1build1","1.648-1","1.651-1","1.652-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.647-1ubuntu0.26.04.4"}]}],"versions":["1.647-1","1.647-1build1","1.647-1ubuntu0.26.04.1","1.647-1ubuntu0.26.04.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.630-1ubuntu0.1~esm9"}]}],"versions":["1.627-1","1.628-1","1.630-1","1.630-1ubuntu0.1~esm1","1.630-1ubuntu0.1~esm4","1.630-1ubuntu0.1~esm5","1.630-1ubuntu0.1~esm6","1.630-1ubuntu0.1~esm8"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.634-1ubuntu0.2+esm5"}]}],"versions":["1.633-1","1.634-1","1.634-1build1","1.634-1ubuntu0.1","1.634-1ubuntu0.2","1.634-1ubuntu0.2+esm1","1.634-1ubuntu0.2+esm2","1.634-1ubuntu0.2+esm4"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.640-1ubuntu0.3+esm4"}]}],"versions":["1.637-1","1.639-1","1.640-1","1.640-1ubuntu0.1","1.640-1ubuntu0.2","1.640-1ubuntu0.3","1.640-1ubuntu0.3+esm1","1.640-1ubuntu0.3+esm3"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.643-1ubuntu0.1+esm4"}]}],"versions":["1.642-1","1.642-1build1","1.643-1","1.643-1ubuntu0.1","1.643-1ubuntu0.1+esm1","1.643-1ubuntu0.1+esm3"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.643-3ubuntu0.4"}]}],"versions":["1.643-3build2","1.643-3build3","1.643-3ubuntu0.1","1.643-3ubuntu0.3"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.643-4ubuntu0.4"}]}],"versions":["1.643-4","1.643-4build1","1.643-4build2","1.643-4build3","1.643-4ubuntu0.1","1.643-4ubuntu0.3"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.647-1ubuntu0.26.04.4"}]}],"versions":["1.647-1","1.647-1build1","1.647-1ubuntu0.26.04.1","1.647-1ubuntu0.26.04.3"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.653.0-1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.647.0-160000.6.1"}]}]}],"references":[{"url":"https://metacpan.org/release/HMBRAND/DBI-1.653/changes","tags":["release-notes","advisory"]},{"url":"https://github.com/perl5-dbi/dbi/commit/315c6ce703b8b3cbe9188062d9ec80730293554a.patch","tags":["patch","fix"]},{"url":"https://github.com/perl5-dbi/dbi/security/advisories/GHSA-wqmw-wqwx-3fr7","tags":["vendor-advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/09/19/4","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78030","tags":["web","advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-78030","tags":["advisory"]},{"url":"https://cpan.org/modules","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/78xxx/CVE-2026-78030.json","tags":["advisory"]},{"url":"https://github.com/perl5-dbi/dbi","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-78030","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0486.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36312","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X2QBTFMS57S7DYK666C4OQBHWDRGW3Q7/","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/09/19/4","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/09/28/12","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/09/28/13","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4186","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4187","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4188","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4189","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623919-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1281704","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78030","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623952-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264346-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264386-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264612-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1283055","tags":["report"]},{"url":"https://bugzilla.suse.com/1283056","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-88815","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-88816","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-78030","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-78030","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8912-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-88816","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73193","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73194","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-78030","title":"DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM","description":"DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM.\n\nDBD::DBM passes the dbm_type and dbm_mldbm connect attributes to require without checking that the value names a module. require treats a path-shaped string as a literal filename and does not consult @INC, so the attribute chooses the file that Perl loads and runs.\n\nThe MLDBM::Serializer:: prefix that DBD::DBM prepends to dbm_mldbm is not a boundary: only the :: separators are rewritten to /, so a value containing / traverses out of the serializer directory. The value is also assigned to $MLDBM::Serializer, which MLDBM requires the same way when it ties the table.\n\nA caller that lets an untrusted party influence either attribute, for example through a DSN fragment or a parameter that selects a storage backend, runs the file-scope code of whatever module the value names.\n\nFor example,\n\n    my $dsn = \"dbi:DBM:f_dir=/var/db;dbm_type=../../Untrusted.pm\"\n    my $dbh = DBI-\u003econnect( $dsn );\n\nNote that DBD::Gofer forwards connect attributes to the server side, and DBI::ProxyServer checks only that a DSN starts with a driver prefix.","status":"published","published":"2026-09-19T10:45:10.164Z","modified":"2026-09-20T00:05:29.533Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-470"],"updated_at":"2026-11-02T13:34:59.78118Z"}],"euvd":[{"id":"EUVD-2026-83584","description":"DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM.\n\nDBD::DBM passes the dbm_type and dbm_mldbm connect attributes to require without checking that the value names a module. require treats a path-shaped string as a literal filename and does not consult @INC, so the attribute chooses the file that Perl loads and runs.\n\nThe MLDBM::Serializer:: prefix that DBD::DBM prepends to dbm_mldbm is not a boundary: only the :: separators are rewritten to /, so a value containing / traverses out of the serializer directory. The value is also assigned to $MLDBM::Serializer, which MLDBM requires the same way when it ties the table.\n\nA caller that lets an untrusted party influence either attribute, for example through a DSN fragment or a parameter that selects a storage backend, runs the file-scope code of whatever module the value names.\n\nFor example,\n\n    my $dsn = \"dbi:DBM:f_dir=/var/db;dbm_type=../../Untrusted.pm\"\n    my $dbh = DBI-\u003econnect( $dsn );\n\nNote that DBD::Gofer forwards connect attributes to the server side, and DBI::ProxyServer checks only that a DSN starts with a driver prefix.","status":"published","published":"2026-09-19T10:45:10Z","modified":"2026-09-20T00:05:29Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T17:28:06.225065Z"}],"nvd":[{"id":"CVE-2026-78030","description":"DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM.\n\nDBD::DBM passes the dbm_type and dbm_mldbm connect attributes to require without checking that the value names a module. require treats a path-shaped string as a literal filename and does not consult @INC, so the attribute chooses the file that Perl loads and runs.\n\nThe MLDBM::Serializer:: prefix that DBD::DBM prepends to dbm_mldbm is not a boundary: only the :: separators are rewritten to /, so a value containing / traverses out of the serializer directory. The value is also assigned to $MLDBM::Serializer, which MLDBM requires the same way when it ties the table.\n\nA caller that lets an untrusted party influence either attribute, for example through a DSN fragment or a parameter that selects a storage backend, runs the file-scope code of whatever module the value names.\n\nFor example,\n\n    my $dsn = \"dbi:DBM:f_dir=/var/db;dbm_type=../../Untrusted.pm\"\n    my $dbh = DBI-\u003econnect( $dsn );\n\nNote that DBD::Gofer forwards connect attributes to the server side, and DBI::ProxyServer checks only that a DSN starts with a driver prefix.","status":"published","published":"2026-09-19T11:16:37.667Z","modified":"2026-09-22T19:07:00.983Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-470"],"updated_at":"2026-11-02T14:12:50.043898Z"}],"osv":[{"id":"BELL-CVE-2026-78030","status":"published","published":"2026-09-15T06:05:26.67655Z","modified":"2026-10-03T07:15:02.276238975Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:26.041478Z"},{"id":"CVE-2026-78030","title":"DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM","description":"DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM.\n\nDBD::DBM passes the dbm_type and dbm_mldbm connect attributes to require without checking that the value names a module. require treats a path-shaped string as a literal filename and does not consult @INC, so the attribute chooses the file that Perl loads and runs.\n\nThe MLDBM::Serializer:: prefix that DBD::DBM prepends to dbm_mldbm is not a boundary: only the :: separators are rewritten to /, so a value containing / traverses out of the serializer directory. The value is also assigned to $MLDBM::Serializer, which MLDBM requires the same way when it ties the table.\n\nA caller that lets an untrusted party influence either attribute, for example through a DSN fragment or a parameter that selects a storage backend, runs the file-scope code of whatever module the value names.\n\nFor example,\n\n    my $dsn = \"dbi:DBM:f_dir=/var/db;dbm_type=../../Untrusted.pm\"\n    my $dbh = DBI-\u003econnect( $dsn );\n\nNote that DBD::Gofer forwards connect attributes to the server side, and DBI::ProxyServer checks only that a DSN starts with a driver prefix.","status":"published","published":"2026-09-19T10:45:10.164Z","modified":"2026-10-28T02:30:46.886158848Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-470"],"updated_at":"2026-11-02T15:45:17.44708Z"},{"id":"DEBIAN-CVE-2026-78030","description":"DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM.  DBD::DBM passes the dbm_type and dbm_mldbm connect attributes to require without checking that the value names a module. require treats a path-shaped string as a literal filename and does not consult @INC, so the attribute chooses the file that Perl loads and runs.  The MLDBM::Serializer:: prefix that DBD::DBM prepends to dbm_mldbm is not a boundary: only the :: separators are rewritten to /, so a value containing / traverses out of the serializer directory. The value is also assigned to $MLDBM::Serializer, which MLDBM requires the same way when it ties the table.  A caller that lets an untrusted party influence either attribute, for example through a DSN fragment or a parameter that selects a storage backend, runs the file-scope code of whatever module the value names.  For example,      my $dsn = \"dbi:DBM:f_dir=/var/db;dbm_type=../../Untrusted.pm\"     my $dbh = DBI-\u003econnect( $dsn );  Note that DBD::Gofer forwards connect attributes to the server side, and DBI::ProxyServer checks only that a DSN starts with a driver prefix.","status":"published","published":"2026-09-19T11:16:37.667Z","modified":"2026-09-29T00:00:08.714194808Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:46:03.502256Z"},{"id":"OESA-2026-4186","title":"perl-DBI security update","description":"The DBI is the standard database interface module for Perl. It defines a set of methods, variables and conventions that provide a consistent database interface independent of the actual database being used. It is important to remember that the DBI is just an interface. The DBI is a layer of \u0026amp;quot;glue\u0026amp;quot; between an application and one or more database driver modules. It is the driver modules which do most of the real work. The DBI provides a standard interface and framework for the drivers to operate within.\r\n\r\nSecurity Fix(es):\n\nDBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM.\n\nDBD::DBM passes the dbm_type and dbm_mldbm connect attributes to require without checking that the value names a module. require treats a path-shaped string as a literal filename and does not consult @INC, so the attribute chooses the file that Perl loads and runs.\n\nThe MLDBM::Serializer:: prefix that DBD::DBM prepends to dbm_mldbm is not a boundary: only the :: separators are rewritten to /, so a value containing / traverses out of the serializer directory. The value is also assigned to $MLDBM::Serializer, which MLDBM requires the same way when it ties the table.\n\nA caller that lets an untrusted party influence either attribute, for example through a DSN fragment or a parameter that selects a storage backend, runs the file-scope code of whatever module the value names.\n\nFor example,\n\n    my $dsn = \u0026quot;dbi:DBM:f_dir=/var/db;dbm_type=../../Untrusted.pm\u0026quot;\n    my $dbh = DBI-\u0026gt;connect( $dsn );\n\nNote that DBD::Gofer forwards connect attributes to the server side, and DBI::ProxyServer checks only that a DSN starts with a driver prefix.(CVE-2026-78030)","status":"published","published":"2026-09-30T13:47:25Z","modified":"2026-10-01T02:00:07.836386059Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-4187","title":"perl-DBI security update","description":"The DBI is the standard database interface module for Perl. It defines a set of methods, variables and conventions that provide a consistent database interface independent of the actual database being used. It is important to remember that the DBI is just an interface. The DBI is a layer of \u0026amp;quot;glue\u0026amp;quot; between an application and one or more database driver modules. It is the driver modules which do most of the real work. The DBI provides a standard interface and framework for the drivers to operate within.\r\n\r\nSecurity Fix(es):\n\nDBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM.\n\nDBD::DBM passes the dbm_type and dbm_mldbm connect attributes to require without checking that the value names a module. require treats a path-shaped string as a literal filename and does not consult @INC, so the attribute chooses the file that Perl loads and runs.\n\nThe MLDBM::Serializer:: prefix that DBD::DBM prepends to dbm_mldbm is not a boundary: only the :: separators are rewritten to /, so a value containing / traverses out of the serializer directory. The value is also assigned to $MLDBM::Serializer, which MLDBM requires the same way when it ties the table.\n\nA caller that lets an untrusted party influence either attribute, for example through a DSN fragment or a parameter that selects a storage backend, runs the file-scope code of whatever module the value names.\n\nFor example,\n\n    my $dsn = \u0026quot;dbi:DBM:f_dir=/var/db;dbm_type=../../Untrusted.pm\u0026quot;\n    my $dbh = DBI-\u0026gt;connect( $dsn );\n\nNote that DBD::Gofer forwards connect attributes to the server side, and DBI::ProxyServer checks only that a DSN starts with a driver prefix.(CVE-2026-78030)","status":"published","published":"2026-09-30T13:47:25Z","modified":"2026-10-01T02:00:07.333931393Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-4188","title":"perl-DBI security update","description":"The DBI is the standard database interface module for Perl. It defines a set of methods, variables and conventions that provide a consistent database interface independent of the actual database being used. It is important to remember that the DBI is just an interface. The DBI is a layer of \u0026amp;quot;glue\u0026amp;quot; between an application and one or more database driver modules. It is the driver modules which do most of the real work. The DBI provides a standard interface and framework for the drivers to operate within.\r\n\r\nSecurity Fix(es):\n\nDBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM.\n\nDBD::DBM passes the dbm_type and dbm_mldbm connect attributes to require without checking that the value names a module. require treats a path-shaped string as a literal filename and does not consult @INC, so the attribute chooses the file that Perl loads and runs.\n\nThe MLDBM::Serializer:: prefix that DBD::DBM prepends to dbm_mldbm is not a boundary: only the :: separators are rewritten to /, so a value containing / traverses out of the serializer directory. The value is also assigned to $MLDBM::Serializer, which MLDBM requires the same way when it ties the table.\n\nA caller that lets an untrusted party influence either attribute, for example through a DSN fragment or a parameter that selects a storage backend, runs the file-scope code of whatever module the value names.\n\nFor example,\n\n    my $dsn = \u0026quot;dbi:DBM:f_dir=/var/db;dbm_type=../../Untrusted.pm\u0026quot;\n    my $dbh = DBI-\u0026gt;connect( $dsn );\n\nNote that DBD::Gofer forwards connect attributes to the server side, and DBI::ProxyServer checks only that a DSN starts with a driver prefix.(CVE-2026-78030)","status":"published","published":"2026-09-30T13:47:26Z","modified":"2026-10-01T02:00:07.327483333Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-4189","title":"perl-DBI security update","description":"The DBI is the standard database interface module for Perl. It defines a set of methods, variables and conventions that provide a consistent database interface independent of the actual database being used. It is important to remember that the DBI is just an interface. The DBI is a layer of \u0026amp;quot;glue\u0026amp;quot; between an application and one or more database driver modules. It is the driver modules which do most of the real work. The DBI provides a standard interface and framework for the drivers to operate within.\r\n\r\nSecurity Fix(es):\n\nDBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM.\n\nDBD::DBM passes the dbm_type and dbm_mldbm connect attributes to require without checking that the value names a module. require treats a path-shaped string as a literal filename and does not consult @INC, so the attribute chooses the file that Perl loads and runs.\n\nThe MLDBM::Serializer:: prefix that DBD::DBM prepends to dbm_mldbm is not a boundary: only the :: separators are rewritten to /, so a value containing / traverses out of the serializer directory. The value is also assigned to $MLDBM::Serializer, which MLDBM requires the same way when it ties the table.\n\nA caller that lets an untrusted party influence either attribute, for example through a DSN fragment or a parameter that selects a storage backend, runs the file-scope code of whatever module the value names.\n\nFor example,\n\n    my $dsn = \u0026quot;dbi:DBM:f_dir=/var/db;dbm_type=../../Untrusted.pm\u0026quot;\n    my $dbh = DBI-\u0026gt;connect( $dsn );\n\nNote that DBD::Gofer forwards connect attributes to the server side, and DBI::ProxyServer checks only that a DSN starts with a driver prefix.(CVE-2026-78030)","status":"published","published":"2026-09-30T13:47:26Z","modified":"2026-10-01T02:00:07.570095931Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"UBUNTU-CVE-2026-78030","description":"DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM. DBD::DBM passes the dbm_type and dbm_mldbm connect attributes to require without checking that the value names a module. require treats a path-shaped string as a literal filename and does not consult @INC, so the attribute chooses the file that Perl loads and runs. The MLDBM::Serializer:: prefix that DBD::DBM prepends to dbm_mldbm is not a boundary: only the :: separators are rewritten to /, so a value containing / traverses out of the serializer directory. The value is also assigned to $MLDBM::Serializer, which MLDBM requires the same way when it ties the table. A caller that lets an untrusted party influence either attribute, for example through a DSN fragment or a parameter that selects a storage backend, runs the file-scope code of whatever module the value names. For example,     my $dsn = \"dbi:DBM:f_dir=/var/db;dbm_type=../../Untrusted.pm\"     my $dbh = DBI-\u003econnect( $dsn ); Note that DBD::Gofer forwards connect attributes to the server side, and DBI::ProxyServer checks only that a DSN starts with a driver prefix.","status":"published","published":"2026-09-19T11:16:00Z","modified":"2026-10-17T13:01:08.819900722Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:57:18.015985Z"},{"id":"AZL-103475","title":"CVE-2026-78030 affecting package perl-DBI for versions less than 1.655-1","description":"DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM.\n\nDBD::DBM passes the dbm_type and dbm_mldbm connect attributes to require without checking that the value names a module. require treats a path-shaped string as a literal filename and does not consult @INC, so the attribute chooses the file that Perl loads and runs.\n\nThe MLDBM::Serializer:: prefix that DBD::DBM prepends to dbm_mldbm is not a boundary: only the :: separators are rewritten to /, so a value containing / traverses out of the serializer directory. The value is also assigned to $MLDBM::Serializer, which MLDBM requires the same way when it ties the table.\n\nA caller that lets an untrusted party influence either attribute, for example through a DSN fragment or a parameter that selects a storage backend, runs the file-scope code of whatever module the value names.\n\nFor example,\n\n    my $dsn = \"dbi:DBM:f_dir=/var/db;dbm_type=../../Untrusted.pm\"\n    my $dbh = DBI-\u003econnect( $dsn );\n\nNote that DBD::Gofer forwards connect attributes to the server side, and DBI::ProxyServer checks only that a DSN starts with a driver prefix.","status":"published","published":"2026-09-19T11:16:37Z","modified":"2026-11-02T14:15:41.400286356Z","updated_at":"2026-11-02T15:28:00.794214Z"},{"id":"MGASA-2026-0486","title":"Updated perl-DBI package fixes security vulnerabilities","description":"DBI versions before 1.653 for Perl load arbitrary modules via\nunvalidated dbm_type and dbm_mldbm attributes in DBD::DBM.\n(CVE-2026-78030)\nDBI versions before 1.654 for Perl incorrectly treat numeric values as\nstrings in sql_type_cast_svpv. (CVE-2026-88815)\nDBI versions before 1.654 for Perl incorrectly treat numeric values as\nstrings in FetchHashKeyName. (CVE-2026-88816)\n","status":"published","published":"2026-10-12T18:47:12Z","modified":"2026-10-12T19:00:45.056075326Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11754-1","title":"perl-DBI-1.653.0-1.1 on GA media","description":"These are all security issues fixed in the perl-DBI-1.653.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-11T00:00:00Z","modified":"2026-09-12T10:30:05.340684681Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:21960-1","title":"Security update for perl-DBI","description":"This update for perl-DBI fixes the following issue:\n\n- CVE-2026-78030: arbitrary modules loaded due to unvalidated `dbm_type` and `dbm_mldbm` attributes in `DBD::DBM`\n  (bsc#1281704).\n","status":"published","published":"2026-09-25T07:38:28Z","modified":"2026-10-01T18:23:09.929503708Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2026-78030","title":"CVE-2026-78030 in libdbi-perl - Patched by Root","description":"Root has patched CVE-2026-78030 in the libdbi-perl package for Root:Debian:12. Multiple fixed versions available.","status":"withdrawn","published":"2026-09-28T12:42:17Z","modified":"2026-10-09T13:00:05.401594235Z","updated_at":"2026-11-02T15:53:32.570806Z"},{"id":"SUSE-SU-2026:23919-1","title":"Security update for perl-DBI","description":"This update for perl-DBI fixes the following issue:\n\n- CVE-2026-78030: arbitrary modules loaded due to unvalidated `dbm_type` and `dbm_mldbm` attributes in `DBD::DBM`\n  (bsc#1281704).\n","status":"published","published":"2026-09-25T07:39:34Z","modified":"2026-09-30T18:23:13.033187991Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:23952-1","title":"Security update for perl-DBI","description":"This update for perl-DBI fixes the following issue:\n\n- CVE-2026-78030: arbitrary modules loaded due to unvalidated `dbm_type` and `dbm_mldbm` attributes in `DBD::DBM`\n  (bsc#1281704).\n","status":"published","published":"2026-09-25T07:39:34Z","modified":"2026-10-02T18:23:11.11256482Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:4346-1","title":"Security update for perl-DBI","description":"This update for perl-DBI fixes the following issue:\n\n- CVE-2026-78030: arbitrary modules loaded due to unvalidated `dbm_type` and `dbm_mldbm` attributes in `DBD::DBM`\n  (bsc#1281704).\n","status":"published","published":"2026-09-24T14:35:58Z","modified":"2026-09-25T09:45:04.058355796Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4386-1","title":"Security update for perl-DBI","description":"This update for perl-DBI fixes the following issue:\n\n- CVE-2026-78030: arbitrary modules loaded due to unvalidated `dbm_type` and `dbm_mldbm` attributes in `DBD::DBM`\n  (bsc#1281704).\n","status":"published","published":"2026-09-29T07:01:14Z","modified":"2026-09-29T18:23:13.697388546Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4612-1","title":"Security update for perl-DBI","description":"This update for perl-DBI fixes the following issues:\n\n- CVE-2026-78030: arbitrary modules loaded due to unvalidated `dbm_type` and `dbm_mldbm` attributes in `DBD::DBM`\n  (bsc#1281704).\n- CVE-2026-88815: numeric value incorrectly treated as strings in `sql_type_cast_svpv` allows for process crash\n  (bsc#1283055).\n- CVE-2026-88816: numeric value incorrectly treated as strings in `FetchHashKeyName` allows for process crash\n  (bsc#1283056).\n","status":"published","published":"2026-10-09T15:56:45Z","modified":"2026-10-10T09:30:06.449818329Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"USN-8912-1","title":"libdbi-perl vulnerabilities","description":"Harsh Raj Singhania discovered that the Perl DBI module did not\ncorrectly validate certain attributes. An attacker could possibly use\nthis issue to execute arbitrary code. (CVE-2026-78030)\n\nHarsh Raj Singhania discovered that the Perl DBI module did not\ncorrectly handle certain string operations. An attacker could possibly\nuse this issue to cause a denial of service. (CVE-2026-88816)","status":"published","published":"2026-10-12T02:53:18Z","modified":"2026-10-12T14:27:53.374176663Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}