DEBIAN-CVE-2026-108518
- Source
- https://security-tracker.debian.org/tracker/CVE-2026-108518
- Import Source
- https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-108518.json
- JSON Data
- https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-108518
- Upstream
- Published
- 2026-10-20T09:47:37Z
- Modified
- 2026-10-21T05:00:06Z
- Summary
- [none]
- Details
-
DBI versions before 1.656 for Perl crash via type confusion in dbi_profile when a database handle is destroyed under a Profile Path with an {attr} element. An {attr} element names a database handle attribute, which dbi_profile reads from the handle's inner hash. It expects the inner handle as a reference and dereferences it, but a handle that is being destroyed hands back the inner hash itself, so the dereference yields the hash's bucket array. A type check on that pointer usually fails and the call goes unprofiled. When the memory it addresses passes the check, the attribute lookup dereferences a NULL or invalid pointer and the process dies on SIGSEGV. The Path is set by the application, by the Profile handle attribute, or by the DBI_PROFILE environment variable, so
DBI_PROFILE={ImplementorClass}can crash an unmodified program. - References
Affected packages
Debian:12 / libdbi-perl
Package
- Name
- libdbi-perl
- Purl
- pkg:deb/debian/libdbi-perl?arch=source&distro=bookworm
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affected
Debian:13 / libdbi-perl
Package
- Name
- libdbi-perl
- Purl
- pkg:deb/debian/libdbi-perl?arch=source&distro=trixie
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affected
Debian:14 / libdbi-perl
Package
- Name
- libdbi-perl
- Purl
- pkg:deb/debian/libdbi-perl?arch=source&distro=forky
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affected