Skip to main content

Perl DBI CVE-2026-60081

| EUVDEUVD-2026-43728 HIGH
Allocation of Resources Without Limits or Throttling (CWE-770)
2026-07-14 CPANSec
Denial Of Service Red Hat Suse Dbi Hmbrand
7.5
CVSS 3.1 · Vendor: CPANSec
Share

Severity by source

Vendor (CPANSec) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Exploitation requires the victim to parse an attacker-supplied profile dump file, so AV:L and UI:R; impact is availability-only memory exhaustion, hence C:N/I:N/A:H.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
6.2 MEDIUM
AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat
2.8 MEDIUM
qualitative

Primary rating from Vendor (CPANSec).

CVSS VectorVendor: CPANSec

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Source Code Evidence Fetched
Jul 15, 2026 - 16:32 vuln.today
Analysis Generated
Jul 15, 2026 - 16:32 vuln.today
CVSS changed
Jul 15, 2026 - 14:22 NVD
7.5 (HIGH)
CVE Published
Jul 14, 2026 - 15:34 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 14, 2026 - 15:34 cve.org
HIGH 7.5

DescriptionCVE.org

DBI::ProfileData versions before 1.651 for Perl do not limit the path index.

The path index column of profile dump files is used to allocate an array of data for the parser. An unbounded value allows an attacker to specify a large index and consume available memory.

AnalysisAI

Memory-exhaustion denial of service in the DBI::ProfileData module (bundled with Perl DBI) before version 1.651 allows an attacker who supplies a crafted profile dump file to force the parser into allocating an oversized array. Because the path-index column is read directly from an untrusted file and used to size an in-memory array, a tiny malicious file can amplify into large memory consumption (CWE-770). There is no public exploit identified at time of analysis and it is not in CISA KEV, but a vendor patch and root-cause commit are available.

Technical ContextAI

DBI is the standard database-access abstraction layer for Perl, and DBI::ProfileData is its utility for reading and parsing the profile dump files produced by DBI::Profile (used by the dbiprof frontend). The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling): in _read_body, the per-line path index ($index) is taken straight from the untrusted profile file and used to expand the @path array. A single huge index value produces a giant sparse array that is then join()ed and copied for every data line, yielding a tiny-file-to-large-memory amplification. The fix commit (6764e755) introduces a configurable $MAX_PATH_DEPTH bound (default 256) and croaks on indices below 0 or above the limit. The affected product is identified by CPE cpe:2.3:a:hmbrand:dbi::profiledata:*:*:*:*:*:*:*:* (author HMBRAND / perl5-dbi).

RemediationAI

Vendor-released patch: upgrade Perl DBI to version 1.651 or later, which bounds the profile-file path index (see the GHSA-ww49-w4mv-jrr4 advisory and the DBI-1.651 changelog at https://metacpan.org/release/HMBRAND/DBI-1.651/changes). The fix is implemented in commit 6764e755e83ee1ebb1b40760e5b53eb50960bd7a, which adds a configurable $DBI::ProfileData::MAX_PATH_DEPTH cap (default 256) and rejects out-of-range indices. If you cannot upgrade immediately, treat all DBI profile dump files as untrusted input: do not run dbiprof or DBI::ProfileData against profile files received from untrusted sources, and restrict who can write the profile dump files that your tooling parses; if you must parse deeper legitimate paths after upgrading, override $MAX_PATH_DEPTH locally rather than removing the check. The trade-off of the input-restriction workaround is operational - it limits legitimate profiling of externally sourced dumps until the patch is applied.

More in Dbi

View all
CVE-2026-14739 CRITICAL
9.8 Jul 07

Heap out-of-bounds write in the Perl DBI database-interface module before version 1.650 occurs when DBI preparses a SQL

CVE-2026-15043 CRITICAL
9.8 Jul 14

Incorrect WHERE-clause evaluation in Perl's DBI::SQL::Nano (versions 1.42 up to 1.651) causes text-based '<=' and '>=' c
CVE-2026-10879 CRITICAL
9.8 Jun 05

Heap buffer overflow in the Perl DBI module versions before 1.648 occurs when the preparse() function processes SQL stat
CVE-2026-9698 CRITICAL
9.8 Jun 09

Stack-based buffer overflow in Perl DBI module versions prior to 1.648 allows attackers who can influence database error
CVE-2026-60082 CRITICAL
9.1 Jul 14

Out-of-bounds read in the Perl DBI (Database Independent Interface) module before version 1.651 lets a caller trigger a

CVE-2026-14740 CRITICAL
9.1 Jul 07

Out-of-bounds read in the Perl DBI module's preparse() SQL-normalisation routine allows an attacker who controls SQL pas
CVE-2026-14380 HIGH
8.8 Jul 07

Arbitrary Perl code execution in the DBI database-interface module (versions before 1.650) allows attackers who influenc

Same weakness CWE-770 – Allocation of Resources Without Limits or Throttling

View all
CVE-2017-8779 HIGH POC
7.5
CVE-2025-53521 CRITICAL POC
9.3
CVE-2017-5850 HIGH POC
7.5
CVE-2025-26682 HIGH
7.5
CVE-2025-41770 HIGH
8.7
CVE-2025-26466 MEDIUM
5.9
CVE-2020-37067 CRITICAL POC
9.8
CVE-2021-47875 CRITICAL POC
9.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Leap 16.0 Fixed
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Affected

Share

CVE-2026-60081 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy