OESA-2026-4598

See a problem?
Please try reporting it to the source first.

Source

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2026-4598

Import Source

https://repo.openeuler.org/security/data/osv/OESA-2026-4598.json

JSON Data

https://api.osv.dev/v1/vulns/OESA-2026-4598

Upstream

CVE-2026-108518

Published

2026-10-29T09:03:24Z

Modified

2026-10-29T09:15:38Z

Severity

4.7 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

perl-DBI security update

Details

The DBI is the standard database interface module for Perl. It defines a set of methods, variables and conventions that provide a consistent database interface independent of the actual database being used. It is important to remember that the DBI is just an interface. The DBI is a layer of "glue" between an application and one or more database driver modules. It is the driver modules which do most of the real work. The DBI provides a standard interface and framework for the drivers to operate within.

Security Fix(es):

DBI versions before 1.656 for Perl crash via type confusion in dbi_profile when a database handle is destroyed under a Profile Path with an {attr} element.

An {attr} element names a database handle attribute, which dbi_profile reads from the handle's inner hash. It expects the inner handle as a reference and dereferences it, but a handle that is being destroyed hands back the inner hash itself, so the dereference yields the hash's bucket array. A type check on that pointer usually fails and the call goes unprofiled. When the memory it addresses passes the check, the attribute lookup dereferences a NULL or invalid pointer and the process dies on SIGSEGV.

The Path is set by the application, by the Profile handle attribute, or by the DBI_PROFILE environment variable, so DBI_PROFILE={ImplementorClass} can crash an unmodified program.(CVE-2026-108518)

Database specific

{
    "severity":  "Medium"
}

References

Affected packages

openEuler:24.03-LTS-SP3 / perl-DBI

Package

Name: perl-DBI
Purl: pkg:rpm/openEuler/perl-DBI&distro=openEuler-24.03-LTS-SP3

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.643-13.oe2403sp3

Ecosystem specific

{
    "aarch64":  [
        "perl-DBI-1.643-13.oe2403sp3.aarch64.rpm",
        "perl-DBI-debuginfo-1.643-13.oe2403sp3.aarch64.rpm",
        "perl-DBI-debugsource-1.643-13.oe2403sp3.aarch64.rpm"
    ],
    "noarch":  [
        "perl-DBI-help-1.643-13.oe2403sp3.noarch.rpm"
    ],
    "src":  [
        "perl-DBI-1.643-13.oe2403sp3.src.rpm"
    ],
    "x86_64":  [
        "perl-DBI-1.643-13.oe2403sp3.x86_64.rpm",
        "perl-DBI-debuginfo-1.643-13.oe2403sp3.x86_64.rpm",
        "perl-DBI-debugsource-1.643-13.oe2403sp3.x86_64.rpm"
    ]
}

Database specific

source

"https://repo.openeuler.org/security/data/osv/OESA-2026-4598.json"