CVE-2026-111879

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-111879

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111879.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-111879

Aliases

GHSA-8cx8-9vj9-9x7j

Downstream

Published

2026-10-20T21:24:00Z

Modified

2026-10-21T10:45:50Z

Summary

DBI versions before 1.656 for Perl hang on a later open of a DBD::DBM table because a failed open_data does not release the table's lock

Details

DBI versions before 1.656 for Perl hang on a later open of a DBD::DBM table because a failed open_data does not release the table's lock.

open_data creates the table's lock file and takes an exclusive flock on it for a CREATE, before the checks that can croak: a dbm_mldbm value that is not a module name, a failing tie, or a missing data file. The croak unwinds before the table object is blessed, so nothing releases the lock, and the meta data holding the open descriptor stays cached on the database handle.

The dbm_mldbm and dbm_type values come from the DSN or the connect attributes, so a caller that chooses the serializer or the storage backend can trigger the failure.

The flock has no timeout, so a later open of that table (even through a separate database handle) blocks for as long as the handle holding the stale lock lives, in the same process or any other.

Database specific

{
    "cna_assigner":  "CPANSec",
    "cwe_ids":  [
        "CWE-667"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111879.json"
}

References

Affected packages

Git / github.com/perl5-dbi/dbi

Affected ranges

Type

GIT

Repo

https://github.com/perl5-dbi/dbi

Events

Introduced

Fixed

1c71a976433b46da98b4844d2ae01326b5a242d7

Fixed

99bbf2ab9d137e6f042a770bd3bbba3bc0b3a901

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "1.656"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "fixed":  "99bbf2ab9d137e6f042a770bd3bbba3bc0b3a901"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

1.*

1.602

1.607

1.611_90

1.611_91

1.611_92

1.611_93

1.611_94

1.613_70

1.613_71

1.613_90

1.613_91

1.613_92

1.613_93

1.614_90

1.615

1.618

1.619

1.622

1.624

1.625

1.626

1.627

1.628

1.630

1.631

1.632

1.632_90

1.633

1.633_90

1.633_91

1.633_92

1.634

1.635

1.636

1.637

1.638

1.639

1.640

1.641

1.642

1.643

1.643_01

1.643_02

1.644

1.645

1.646

1.647

1.648

1.649

1.650

1.651

1.652

1.653

1.654

1.655

DBI-1.*

DBI-1.47

DBI-1.51

DBI-1.57

DBI-1.58

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111879.json"