{"dataType": "CVE_RECORD", "containers": {"adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "Unknown", "content": {"data": "{\"description\":\"Important\"}"}}}], "affected": [{"vendor": "redhat", "product": "perl-DBI", "platforms": ["cpe:/o:redhat:enterprise_linux:6"], "defaultStatus": "affected"}], "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-14380"}], "descriptions": [{"lang": "en", "value": "A flaw was found in the DBI component for Perl. This vulnerability allows an attacker to inject and execute arbitrary code by manipulating the Profile attribute of a DBI handle. When a string is assigned to this attribute, the component processes it without proper validation, enabling the execution of unauthorized Perl code, including system commands. An attacker with control over certain inputs, such as environment variables or connection string parameters, could exploit this to achieve arbitrary code execution on the affected system. In some configurations, this could lead to remote code execution. \n            This Important vulnerability in the Perl DBI component allows for arbitrary code execution due to improper validation of the `Profile` attribute. An attacker can exploit this by controlling inputs such as the `DBI_PROFILE` environment variable or DSN parameters, leading to the execution of unauthorized Perl code.\n            To reduce the risk of arbitrary code execution, avoid setting the `DBI_PROFILE` environment variable from untrusted sources. Ensure that DSN driver-attribute clauses, particularly those used with `dbi:Driver(Profile=>SPEC):db`, are not populated with unvalidated or untrusted input."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-07-07T22:04:00Z", "x_subShortName": "redhat_6"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "Unknown", "content": {"data": "{\"description\":\"Important\"}"}}}], "affected": [{"vendor": "redhat", "product": "perl-DBI", "platforms": ["cpe:/o:redhat:enterprise_linux:7"], "defaultStatus": "affected"}], "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-14380"}], "descriptions": [{"lang": "en", "value": "A flaw was found in the DBI component for Perl. This vulnerability allows an attacker to inject and execute arbitrary code by manipulating the Profile attribute of a DBI handle. When a string is assigned to this attribute, the component processes it without proper validation, enabling the execution of unauthorized Perl code, including system commands. An attacker with control over certain inputs, such as environment variables or connection string parameters, could exploit this to achieve arbitrary code execution on the affected system. In some configurations, this could lead to remote code execution. \n            This Important vulnerability in the Perl DBI component allows for arbitrary code execution due to improper validation of the `Profile` attribute. An attacker can exploit this by controlling inputs such as the `DBI_PROFILE` environment variable or DSN parameters, leading to the execution of unauthorized Perl code.\n            To reduce the risk of arbitrary code execution, avoid setting the `DBI_PROFILE` environment variable from untrusted sources. Ensure that DSN driver-attribute clauses, particularly those used with `dbi:Driver(Profile=>SPEC):db`, are not populated with unvalidated or untrusted input."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-07-07T22:04:00Z", "x_subShortName": "redhat_7"}}, {"metrics": [{"other": {"type": "Unknown", "content": {"data": "{\"description\":\"not yet assigned\"}"}}}], "affected": [{"vendor": "debian", "product": "libdbi-perl", "versions": [{"status": "affected", "version": "0", "lessThan": "1.643-4+deb12u2", "versionType": "deb"}], "platforms": ["bookworm"], "defaultStatus": "unaffected"}, {"vendor": "debian", "product": "libdbi-perl-dbgsym", "versions": [{"status": "affected", "version": "0", "lessThan": "1.643-4+deb12u2", "versionType": "deb"}], "platforms": ["bookworm"], "defaultStatus": "unaffected"}, {"vendor": "debian", "product": "libdbi-perl", "versions": [{"status": "affected", "version": "0", "lessThan": "1.650-1", "versionType": "deb"}], "platforms": ["forky", "sid"], "defaultStatus": "unaffected"}, {"vendor": "debian", "product": "libdbi-perl-dbgsym", "versions": [{"status": "affected", "version": "0", "lessThan": "1.650-1", "versionType": "deb"}], "platforms": ["forky", "sid"], "defaultStatus": "unaffected"}, {"vendor": "debian", "product": "libdbi-perl", "versions": [{"status": "affected", "version": "0", "lessThan": "1.652-2~deb13u1", "versionType": "deb"}], "platforms": ["trixie"], "defaultStatus": "unaffected"}, {"vendor": "debian", "product": "libdbi-perl-dbgsym", "versions": [{"status": "affected", "version": "0", "lessThan": "1.652-2~deb13u1", "versionType": "deb"}], "platforms": ["trixie"], "defaultStatus": "unaffected"}], "references": [{"url": "https://security-tracker.debian.org/tracker/CVE-2026-14380"}], "descriptions": [{"lang": "en", "value": "DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile.  When a string is assigned to a DBI handle's Profile attribute, DBI splits it into path, package and arguments, and interpolates the package part in a string eval with no validation of the package name.  Any caller-influenced value that reaches the Profile attribute is therefore arbitrary Perl code execution, including calls to run system commands.  The Profile attribute can be set from three different sources that can carry untrusted data: the DBI_PROFILE environment variable, a direct attribute assignment, and a DSN driver-attribute clause dbi:Driver(Profile=>SPEC):db.  An attacker controlling any of those inputs runs arbitrary Perl in the host process. The strongest remote position is a network-exposed DBI::Gofer / DBI::ProxyServer whose per-request DSN reaches the Profile attribute, letting a client execute code on the broker host."}], "providerMetadata": {"orgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5", "shortName": "debian", "dateUpdated": "2026-08-27T00:00:00.000Z", "x_subShortName": "debian"}}, {"credits": [{"lang": "en", "value": "packager@almalinux.org"}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "Unknown", "content": {"data": "{\"description\":\"Important\"}"}}}], "affected": [{"vendor": "almalinux", "product": "perl-DBI", "versions": [{"status": "affected", "version": "0", "lessThan": "0:1.643-26.el10_2.3", "versionType": "rpm"}], "platforms": ["cpe:/o:almalinux:almalinux:10"], "defaultStatus": "unaffected"}], "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-14380", "name": "CVE-2026-14380"}], "descriptions": [{"lang": "en", "value": "DBI is a database access Application Programming Interface (API) for the Perl Language. The DBI API Specification defines a set of functions, variables and conventions that provide a consistent database interface independent of the actual database being used.  \n\nSecurity Fix(es):  \n\n  * DBI: DBI: Arbitrary code execution via caller-influenced Profile attribute (CVE-2026-14380)\n  * DBI: DBI: Heap overflow when preparsing SQL statements with excessive placeholders (CVE-2026-14739)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n"}], "providerMetadata": {"orgId": "00000000-0000-4000-A000-000000000001", "shortName": "almalinux", "dateUpdated": "2026-08-03T00:00:00Z", "x_subShortName": "alma_10"}}, {"credits": [{"lang": "en", "value": "packager@almalinux.org"}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "Unknown", "content": {"data": "{\"description\":\"Important\"}"}}}], "affected": [{"vendor": "almalinux", "product": "perl-DBI", "versions": [{"status": "affected", "version": "0", "lessThan": "0:1.641-2.el8_10", "versionType": "rpm"}, {"status": "affected", "version": "0", "lessThan": "0:1.641-8.module_el8.10.0+4245+6005333d", "versionType": "rpm"}], "platforms": ["cpe:/o:almalinux:almalinux:8"], "defaultStatus": "unaffected"}], "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-14380", "name": "CVE-2026-14380"}], "descriptions": [{"lang": "en", "value": "DBI is a database access Application Programming Interface (API) for the Perl Language. The DBI API Specification defines a set of functions, variables and conventions that provide a consistent database interface independent of the actual database being used.  \n\nSecurity Fix(es):  \n\n  * perl-DBI: perl-DBI: Heap overflow in SQL preparsing can lead to denial of service or arbitrary code execution. (CVE-2026-10879)\n  * DBI: DBI: Buffer overflow in error handling can lead to arbitrary code execution (CVE-2026-9698)\n  * DBI: DBI: Arbitrary code execution via caller-influenced Profile attribute (CVE-2026-14380)\n  * DBI: DBI: Heap overflow when preparsing SQL statements with excessive placeholders (CVE-2026-14739)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n"}, {"lang": "en", "value": "The perl-DBI package provides the standard database interface module for the  \nPerl programming language. It implements a database-independent interface,  \nmeaning it defines a consistent set of methods, variables, and conventions for  \ndatabase operations.  \n\nSecurity Fix(es):  \n\n  * DBI: Heap overflow when preparsing SQL statements with excessive placeholders (CVE-2026-14739)\n  * DBI: Arbitrary code execution via caller-influenced Profile attribute (CVE-2026-14380)\n\n\nFor more details about the security issue(s), including the impact, a CVSS  \nscore, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n"}], "providerMetadata": {"orgId": "00000000-0000-4000-A000-000000000001", "shortName": "almalinux", "dateUpdated": "2026-08-10T00:00:00Z", "x_subShortName": "alma_8"}}, {"credits": [{"lang": "en", "value": "packager@almalinux.org"}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "Unknown", "content": {"data": "{\"description\":\"Important\"}"}}}], "affected": [{"vendor": "almalinux", "product": "perl-DBI", "versions": [{"status": "affected", "version": "0", "lessThan": "0:1.643-9.el9_8.3", "versionType": "rpm"}], "platforms": ["cpe:/o:almalinux:almalinux:9"], "defaultStatus": "unaffected"}], "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-14380", "name": "CVE-2026-14380"}], "descriptions": [{"lang": "en", "value": "DBI is a database access Application Programming Interface (API) for the Perl Language. The DBI API Specification defines a set of functions, variables and conventions that provide a consistent database interface independent of the actual database being used.  \n\nSecurity Fix(es):  \n\n  * DBI: DBI: Arbitrary code execution via caller-influenced Profile attribute (CVE-2026-14380)\n  * DBI: DBI: Heap overflow when preparsing SQL statements with excessive placeholders (CVE-2026-14739)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n"}], "providerMetadata": {"orgId": "00000000-0000-4000-A000-000000000001", "shortName": "almalinux", "dateUpdated": "2026-08-03T00:00:00Z", "x_subShortName": "alma_9"}}, {"metrics": [{"other": {"type": "Unknown", "content": {"data": "{\"description\":\"high\"}"}}}], "affected": [{"vendor": "fedora", "product": "perl-DBI", "versions": [{"status": "affected", "version": "0", "lessThan": "0:1.651-1.fc43", "versionType": "rpm"}], "platforms": ["cpe:/o:fedoraproject:fedora:43"], "defaultStatus": "unaffected"}, {"vendor": "fedora", "product": "perl-DBI", "versions": [{"status": "affected", "version": "0", "lessThan": "0:1.651-1.fc44", "versionType": "rpm"}], "platforms": ["cpe:/o:fedoraproject:fedora:44"], "defaultStatus": "unaffected"}], "references": [{"url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-1c5ffc6018"}, {"url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-c0abcba354"}], "descriptions": [{"lang": "en", "value": "perl-DBI: DBI: Arbitrary code execution via caller-influenced Profile attribute"}], "providerMetadata": {"orgId": "92fb86c3-55a5-4fb5-9c3f-4757b9e96dc5", "shortName": "fedora", "dateUpdated": "2026-07-23T01:01:59Z", "x_subShortName": "fedora"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "Unknown", "content": {"data": "{\"description\":\"IMPORTANT\"}"}}}], "affected": [{"vendor": "oraclelinux", "product": "perl-DBI", "versions": [{"status": "affected", "version": "0", "lessThan": "0:1.643-26.el10_2.3", "versionType": "rpm"}], "platforms": ["cpe:/o:oracle:linux:10"], "defaultStatus": "unaffected"}, {"vendor": "oraclelinux", "product": "perl-DBI", "versions": [{"status": "affected", "version": "0", "lessThan": "0:1.641-2.el8_10", "versionType": "rpm"}, {"status": "affected", "version": "0", "lessThan": "0:1.641-8.module+el8.10.0+90986+45c0847f", "versionType": "rpm"}, {"status": "affected", "version": "0", "lessThan": "0:1.641-8.module+el8.10.0+90987+dfc813d3", "versionType": "rpm"}], "platforms": ["cpe:/o:oracle:linux:8"], "defaultStatus": "unaffected"}, {"vendor": "oraclelinux", "product": "perl-DBI", "versions": [{"status": "affected", "version": "0", "lessThan": "0:1.643-9.el9_8.3", "versionType": "rpm"}], "platforms": ["cpe:/o:oracle:linux:9"], "defaultStatus": "unaffected"}], "references": [{"url": "https://linux.oracle.com/cve/CVE-2026-14380.html"}], "descriptions": [{"lang": "en", "value": "DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile.\n\nWhen a string is assigned to a DBI handle's Profile attribute, DBI splits it into path, package and arguments, and interpolates the package part in a string eval with no validation of the package name.\n\nAny caller-influenced value that reaches the Profile attribute is therefore arbitrary Perl code execution, including calls to run system commands.\n\nThe Profile attribute can be set from three different sources that can carry untrusted data: the DBI_PROFILE environment variable, a direct attribute assignment, and a DSN driver-attribute clause dbi:Driver(Profile=>SPEC):db.\n\nAn attacker controlling any of those inputs runs arbitrary Perl in the host process. The strongest remote position is a network-exposed DBI::Gofer / DBI::ProxyServer whose per-request DSN reaches the Profile attribute, letting a client execute code on the broker host."}], "providerMetadata": {"orgId": "00000000-0000-4000-A000-000000000006", "shortName": "oraclelinux", "dateUpdated": "2026-08-03T00:00:00Z", "x_subShortName": "oraclelinux"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "Unknown", "content": {"data": "{\"description\":\"Important\"}"}}}], "affected": [{"vendor": "redhat", "product": "perl-DBI", "versions": [{"status": "affected", "version": "0", "lessThan": "0:1.643-26.el10_2.3", "versionType": "rpm"}], "platforms": ["cpe:/o:redhat:enterprise_linux:10"], "defaultStatus": "unaffected"}, {"vendor": "redhat", "product": "perl-DBI-debuginfo", "versions": [{"status": "affected", "version": "0", "lessThan": "0:1.643-26.el10_2.3", "versionType": "rpm"}], "platforms": ["cpe:/o:redhat:enterprise_linux:10"], "defaultStatus": "unaffected"}, {"vendor": "redhat", "product": "perl-DBI-debugsource", "versions": [{"status": "affected", "version": "0", "lessThan": "0:1.643-26.el10_2.3", "versionType": "rpm"}], "platforms": ["cpe:/o:redhat:enterprise_linux:10"], "defaultStatus": "unaffected"}], "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-14380"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497915"}, {"url": "https://github.com/perl5-dbi/dbi/commit/b73d5d9901767fc1d16b6661ef08fbed4532e259.patch"}, {"url": "https://github.com/perl5-dbi/dbi/security/advisories/GHSA-ch8w-hxc2-v557"}, {"url": "https://metacpan.org/release/HMBRAND/DBI-1.650/changes"}, {"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14380"}, {"url": "https://www.cve.org/CVERecord?id=CVE-2026-14380"}], "descriptions": [{"lang": "en", "value": "A flaw was found in the DBI component for Perl. This vulnerability allows an attacker to inject and execute arbitrary code by manipulating the Profile attribute of a DBI handle. When a string is assigned to this attribute, the component processes it without proper validation, enabling the execution of unauthorized Perl code, including system commands. An attacker with control over certain inputs, such as environment variables or connection string parameters, could exploit this to achieve arbitrary code execution on the affected system. In some configurations, this could lead to remote code execution."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-07-07T22:04:49Z", "x_subShortName": "redhat_10"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "Unknown", "content": {"data": "{\"description\":\"Important\"}"}}}], "affected": [{"vendor": "redhat", "product": "perl-DBI", "versions": [{"status": "affected", "version": "0", "lessThan": "0:1.641-2.el8_10", "versionType": "rpm"}, {"status": "affected", "version": "0", "lessThan": "0:1.641-8.module+el8.10.0+24620+2953b6e4", "versionType": "rpm"}, {"status": "affected", "version": "0", "lessThan": "0:1.641-8.module+el8.10.0+24620+ff0e05e9", "versionType": "rpm"}], "platforms": ["cpe:/o:redhat:enterprise_linux:8"], "defaultStatus": "unaffected"}], "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:52772"}, {"url": "https://access.redhat.com/errata/RHSA-2026:62667"}, {"url": "https://access.redhat.com/security/cve/CVE-2026-14380"}], "descriptions": [{"lang": "en", "value": "DBI is a database access Application Programming Interface (API) for the Perl Language. The DBI API Specification defines a set of functions, variables and conventions that provide a consistent database interface independent of the actual database being used.\n\nSecurity Fix(es):\n\n* perl-DBI: perl-DBI: Heap overflow in SQL preparsing can lead to denial of service or arbitrary code execution. (CVE-2026-10879)\n\n* DBI: DBI: Buffer overflow in error handling can lead to arbitrary code execution (CVE-2026-9698)\n\n* DBI: DBI: Arbitrary code execution via caller-influenced Profile attribute (CVE-2026-14380)\n\n* DBI: DBI: Heap overflow when preparsing SQL statements with excessive placeholders (CVE-2026-14739)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section."}, {"lang": "en", "value": "The perl-DBI package provides the standard database interface module for the\nPerl programming language. It implements a database-independent interface,\nmeaning it defines a consistent set of methods, variables, and conventions for\ndatabase operations.\n\nSecurity Fix(es):\n\n* DBI: Heap overflow when preparsing SQL statements with excessive placeholders (CVE-2026-14739)\n\n* DBI: Arbitrary code execution via caller-influenced Profile attribute (CVE-2026-14380)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-07-07T22:04:00Z", "x_subShortName": "redhat_8"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "Unknown", "content": {"data": "{\"description\":\"Important\"}"}}}], "affected": [{"vendor": "redhat", "product": "perl-DBI", "versions": [{"status": "affected", "version": "0", "lessThan": "0:1.643-9.el9_8.3", "versionType": "rpm"}], "platforms": ["cpe:/o:redhat:enterprise_linux:9"], "defaultStatus": "unaffected"}], "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:49612"}, {"url": "https://access.redhat.com/security/cve/CVE-2026-14380"}], "descriptions": [{"lang": "en", "value": "DBI is a database access Application Programming Interface (API) for the Perl Language. The DBI API Specification defines a set of functions, variables and conventions that provide a consistent database interface independent of the actual database being used.\n\nSecurity Fix(es):\n\n* DBI: DBI: Arbitrary code execution via caller-influenced Profile attribute (CVE-2026-14380)\n\n* DBI: DBI: Heap overflow when preparsing SQL statements with excessive placeholders (CVE-2026-14739)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-07-07T22:04:00Z", "x_subShortName": "redhat_9"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "Unknown", "content": {"data": "{\"description\":\"Important\"}"}}}], "affected": [{"vendor": "rocky", "product": "perl-DBI", "versions": [{"status": "affected", "version": "0", "lessThan": "0:1.643-26.el10_2.3", "versionType": "rpm"}], "platforms": ["cpe:/o:rocky:rocky:10"], "defaultStatus": "unaffected"}, {"vendor": "rocky", "product": "perl-DBI-debuginfo", "versions": [{"status": "affected", "version": "0", "lessThan": "0:1.643-26.el10_2.3", "versionType": "rpm"}], "platforms": ["cpe:/o:rocky:rocky:10"], "defaultStatus": "unaffected"}, {"vendor": "rocky", "product": "perl-DBI-debugsource", "versions": [{"status": "affected", "version": "0", "lessThan": "0:1.643-26.el10_2.3", "versionType": "rpm"}], "platforms": ["cpe:/o:rocky:rocky:10"], "defaultStatus": "unaffected"}, {"vendor": "rocky", "product": "perl-DBI", "versions": [{"status": "affected", "version": "0", "lessThan": "0:1.641-2.el8_10", "versionType": "rpm"}, {"status": "affected", "version": "0", "lessThan": "0:1.641-8.module+el8.10.0+40273+0bbde87c", "versionType": "rpm"}, {"status": "affected", "version": "0", "lessThan": "0:1.641-8.module+el8.10.0+40273+4d327a6c", "versionType": "rpm"}, {"status": "affected", "version": "0", "lessThan": "0:1.641-8.module+el8.10.0+40273+66ce089d", "versionType": "rpm"}, {"status": "affected", "version": "0", "lessThan": "0:1.641-8.module+el8.10.0+40273+d479100a", "versionType": "rpm"}], "platforms": ["cpe:/o:rocky:rocky:8"], "defaultStatus": "unaffected"}, {"vendor": "rocky", "product": "perl-DBI-debuginfo", "versions": [{"status": "affected", "version": "0", "lessThan": "0:1.641-2.el8_10", "versionType": "rpm"}, {"status": "affected", "version": "0", "lessThan": "0:1.641-8.module+el8.10.0+40273+0bbde87c", "versionType": "rpm"}, {"status": "affected", "version": "0", "lessThan": "0:1.641-8.module+el8.10.0+40273+4d327a6c", "versionType": "rpm"}, {"status": "affected", "version": "0", "lessThan": "0:1.641-8.module+el8.10.0+40273+66ce089d", "versionType": "rpm"}, {"status": "affected", "version": "0", "lessThan": "0:1.641-8.module+el8.10.0+40273+d479100a", "versionType": "rpm"}], "platforms": ["cpe:/o:rocky:rocky:8"], "defaultStatus": "unaffected"}, {"vendor": "rocky", "product": "perl-DBI-debugsource", "versions": [{"status": "affected", "version": "0", "lessThan": "0:1.641-2.el8_10", "versionType": "rpm"}, {"status": "affected", "version": "0", "lessThan": "0:1.641-8.module+el8.10.0+40273+0bbde87c", "versionType": "rpm"}, {"status": "affected", "version": "0", "lessThan": "0:1.641-8.module+el8.10.0+40273+4d327a6c", "versionType": "rpm"}, {"status": "affected", "version": "0", "lessThan": "0:1.641-8.module+el8.10.0+40273+66ce089d", "versionType": "rpm"}, {"status": "affected", "version": "0", "lessThan": "0:1.641-8.module+el8.10.0+40273+d479100a", "versionType": "rpm"}], "platforms": ["cpe:/o:rocky:rocky:8"], "defaultStatus": "unaffected"}, {"vendor": "rocky", "product": "perl-DBI", "versions": [{"status": "affected", "version": "0", "lessThan": "0:1.643-9.el9_8.3", "versionType": "rpm"}], "platforms": ["cpe:/o:rocky:rocky:9"], "defaultStatus": "unaffected"}, {"vendor": "rocky", "product": "perl-DBI-debuginfo", "versions": [{"status": "affected", "version": "0", "lessThan": "0:1.643-9.el9_8.3", "versionType": "rpm"}], "platforms": ["cpe:/o:rocky:rocky:9"], "defaultStatus": "unaffected"}, {"vendor": "rocky", "product": "perl-DBI-debugsource", "versions": [{"status": "affected", "version": "0", "lessThan": "0:1.643-9.el9_8.3", "versionType": "rpm"}], "platforms": ["cpe:/o:rocky:rocky:9"], "defaultStatus": "unaffected"}], "references": [{"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2485464"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486734"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497915"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497916"}], "descriptions": [{"lang": "en", "value": "DBI: Arbitrary code execution via caller-influenced Profile attribute (CVE-2026-14380)"}, {"lang": "en", "value": "DBI: DBI: Arbitrary code execution via caller-influenced Profile attribute (CVE-2026-14380)"}], "providerMetadata": {"orgId": "00000000-0000-4000-A000-000000000004", "shortName": "rocky", "dateUpdated": "2026-08-04T12:03:54Z", "x_subShortName": "rocky"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "Unknown", "content": {"data": "{\"description\":\"Important\"}"}}}], "affected": [{"vendor": "suse", "product": "perl-DBI", "versions": [{"status": "affected", "version": "0", "lessThan": "0:1.642-150200.3.19.1", "versionType": "rpm"}], "platforms": ["cpe:/o:suse:oes-release:23.4", "cpe:/o:suse:oes-release:24.4", "cpe:/o:suse:sle_hpc:15:sp4", "cpe:/o:suse:sle_hpc:15:sp5", "cpe:/o:suse:sles-ltss:15:sp4", "cpe:/o:suse:sles-ltss:15:sp5", "cpe:/o:suse:sles:15:sp4", "cpe:/o:suse:sles:15:sp5", "cpe:/o:suse:sles_sap:15:sp4", "cpe:/o:suse:sles_sap:15:sp5", "cpe:/o:suse:sles_teradata:15:sp4"], "defaultStatus": "unaffected"}, {"vendor": "suse", "product": "perl-DBI", "versions": [{"status": "affected", "version": "0", "lessThan": "0:1.647.0-150600.12.18.1", "versionType": "rpm"}], "platforms": ["cpe:/o:suse:oes-release:25.4", "cpe:/o:suse:sle-module-basesystem:15:sp7", "cpe:/o:suse:sled:15:sp7", "cpe:/o:suse:sles-ltss:15:sp6", "cpe:/o:suse:sles:15:sp6", "cpe:/o:suse:sles:15:sp7", "cpe:/o:suse:sles_sap:15:sp6", "cpe:/o:suse:sles_sap:15:sp7"], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "SUSE bug 1271018"}, {"lang": "en", "value": "SUSE bug 1279550"}], "references": [{"url": "https://lists.suse.com/pipermail/suse-liberty-linux-updates/2026-August/007386.html", "name": "ESSA-2026:0151"}, {"url": "https://lists.suse.com/pipermail/suse-liberty-linux-updates/2026-August/007387.html", "name": "ESSA-2026:0152"}, {"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14380", "name": "Mitre CVE-2026-14380"}, {"url": "https://lists.suse.com/pipermail/suse-liberty-linux-updates/2026-August/007312.html", "name": "RHSA-2026:49514"}, {"url": "https://lists.suse.com/pipermail/suse-liberty-linux-updates/2026-August/007333.html", "name": "RHSA-2026:49612"}, {"url": "https://lists.suse.com/pipermail/suse-liberty-linux-updates/2026-September/007696.html", "name": "RHSA-2026:62667"}, {"url": "https://www.suse.com/security/cve/CVE-2026-14380", "name": "SUSE CVE-2026-14380"}, {"url": "https://lists.suse.com/pipermail/sle-updates/2026-July/048281.html", "name": "SUSE-SU-2026:22592-1"}, {"url": "https://lists.suse.com/pipermail/sle-updates/2026-July/048389.html", "name": "SUSE-SU-2026:22623-1"}, {"url": "https://lists.suse.com/pipermail/sle-security-updates/2026-July/027949.html", "name": "SUSE-SU-2026:3283-1"}, {"url": "https://lists.suse.com/pipermail/sle-updates/2026-July/048963.html", "name": "SUSE-SU-2026:3415-1"}, {"url": "https://lists.suse.com/pipermail/sle-updates/2026-August/049046.html", "name": "SUSE-SU-2026:3461-1"}], "descriptions": [{"lang": "en", "value": "\n    DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile.\n\nWhen a string is assigned to a DBI handle's Profile attribute, DBI splits it into path, package and arguments, and interpolates the package part in a string eval with no validation of the package name.\n\nAny caller-influenced value that reaches the Profile attribute is therefore arbitrary Perl code execution, including calls to run system commands.\n\nThe Profile attribute can be set from three different sources that can carry untrusted data: the DBI_PROFILE environment variable, a direct attribute assignment, and a DSN driver-attribute clause dbi:Driver(Profile=>SPEC):db.\n\nAn attacker controlling any of those inputs runs arbitrary Perl in the host process. The strongest remote position is a network-exposed DBI::Gofer / DBI::ProxyServer whose per-request DSN reaches the Profile attribute, letting a client execute code on the broker host.\n    "}], "providerMetadata": {"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "shortName": "suse", "dateUpdated": "2026-07-28T00:00:00Z", "x_subShortName": "suse_server_15"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "Unknown", "content": {"data": "{\"description\":\"Important\"}"}}}], "affected": [{"vendor": "suse", "product": "perl-DBI", "versions": [{"status": "affected", "version": "0", "lessThan": "0:1.647.0-150600.12.18.1", "versionType": "rpm"}], "platforms": ["cpe:/o:suse:oes-release:25.4", "cpe:/o:suse:sle-module-basesystem:15:sp7", "cpe:/o:suse:sled:15:sp7", "cpe:/o:suse:sles:15:sp7", "cpe:/o:suse:sles_sap:15:sp7"], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "SUSE bug 1271018"}, {"lang": "en", "value": "SUSE bug 1279550"}], "references": [{"url": "https://lists.suse.com/pipermail/suse-liberty-linux-updates/2026-August/007386.html", "name": "ESSA-2026:0151"}, {"url": "https://lists.suse.com/pipermail/suse-liberty-linux-updates/2026-August/007387.html", "name": "ESSA-2026:0152"}, {"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14380", "name": "Mitre CVE-2026-14380"}, {"url": "https://lists.suse.com/pipermail/suse-liberty-linux-updates/2026-August/007312.html", "name": "RHSA-2026:49514"}, {"url": "https://lists.suse.com/pipermail/suse-liberty-linux-updates/2026-August/007333.html", "name": "RHSA-2026:49612"}, {"url": "https://lists.suse.com/pipermail/suse-liberty-linux-updates/2026-September/007696.html", "name": "RHSA-2026:62667"}, {"url": "https://www.suse.com/security/cve/CVE-2026-14380", "name": "SUSE CVE-2026-14380"}, {"url": "https://lists.suse.com/pipermail/sle-updates/2026-July/048281.html", "name": "SUSE-SU-2026:22592-1"}, {"url": "https://lists.suse.com/pipermail/sle-updates/2026-July/048389.html", "name": "SUSE-SU-2026:22623-1"}, {"url": "https://lists.suse.com/pipermail/sle-security-updates/2026-July/027949.html", "name": "SUSE-SU-2026:3283-1"}, {"url": "https://lists.suse.com/pipermail/sle-updates/2026-July/048963.html", "name": "SUSE-SU-2026:3415-1"}, {"url": "https://lists.suse.com/pipermail/sle-updates/2026-August/049046.html", "name": "SUSE-SU-2026:3461-1"}], "descriptions": [{"lang": "en", "value": "\n    DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile.\n\nWhen a string is assigned to a DBI handle's Profile attribute, DBI splits it into path, package and arguments, and interpolates the package part in a string eval with no validation of the package name.\n\nAny caller-influenced value that reaches the Profile attribute is therefore arbitrary Perl code execution, including calls to run system commands.\n\nThe Profile attribute can be set from three different sources that can carry untrusted data: the DBI_PROFILE environment variable, a direct attribute assignment, and a DSN driver-attribute clause dbi:Driver(Profile=>SPEC):db.\n\nAn attacker controlling any of those inputs runs arbitrary Perl in the host process. The strongest remote position is a network-exposed DBI::Gofer / DBI::ProxyServer whose per-request DSN reaches the Profile attribute, letting a client execute code on the broker host.\n    "}], "providerMetadata": {"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "shortName": "suse", "dateUpdated": "2026-07-31T00:00:00Z", "x_subShortName": "suse_desktop_15"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "Unknown", "content": {"data": "{\"description\":\"Important\"}"}}}], "affected": [{"vendor": "suse", "product": "perl-DBI", "versions": [{"status": "affected", "version": "0", "lessThan": "0:1.647.0-160000.4.1", "versionType": "rpm"}], "platforms": ["cpe:/o:suse:sles:16.0", "cpe:/o:suse:sles_sap:16.0"], "defaultStatus": "unaffected"}, {"vendor": "suse", "product": "perl-DBI", "versions": [{"status": "affected", "version": "0", "lessThan": "0:1.651.0-160100.2.1", "versionType": "rpm"}], "platforms": ["cpe:/o:suse:sles:16.1", "cpe:/o:suse:sles_sap:16.1"], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "SUSE bug 1271018"}, {"lang": "en", "value": "SUSE bug 1279550"}], "references": [{"url": "https://lists.suse.com/pipermail/suse-liberty-linux-updates/2026-August/007386.html", "name": "ESSA-2026:0151"}, {"url": "https://lists.suse.com/pipermail/suse-liberty-linux-updates/2026-August/007387.html", "name": "ESSA-2026:0152"}, {"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14380", "name": "Mitre CVE-2026-14380"}, {"url": "https://lists.suse.com/pipermail/suse-liberty-linux-updates/2026-August/007312.html", "name": "RHSA-2026:49514"}, {"url": "https://lists.suse.com/pipermail/suse-liberty-linux-updates/2026-August/007333.html", "name": "RHSA-2026:49612"}, {"url": "https://lists.suse.com/pipermail/suse-liberty-linux-updates/2026-September/007696.html", "name": "RHSA-2026:62667"}, {"url": "https://www.suse.com/security/cve/CVE-2026-14380", "name": "SUSE CVE-2026-14380"}, {"url": "https://lists.suse.com/pipermail/sle-updates/2026-July/048281.html", "name": "SUSE-SU-2026:22592-1"}, {"url": "https://lists.suse.com/pipermail/sle-updates/2026-July/048389.html", "name": "SUSE-SU-2026:22623-1"}, {"url": "https://lists.suse.com/pipermail/sle-security-updates/2026-July/027949.html", "name": "SUSE-SU-2026:3283-1"}, {"url": "https://lists.suse.com/pipermail/sle-updates/2026-July/048963.html", "name": "SUSE-SU-2026:3415-1"}, {"url": "https://lists.suse.com/pipermail/sle-updates/2026-August/049046.html", "name": "SUSE-SU-2026:3461-1"}], "descriptions": [{"lang": "en", "value": "\n    DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile.\n\nWhen a string is assigned to a DBI handle's Profile attribute, DBI splits it into path, package and arguments, and interpolates the package part in a string eval with no validation of the package name.\n\nAny caller-influenced value that reaches the Profile attribute is therefore arbitrary Perl code execution, including calls to run system commands.\n\nThe Profile attribute can be set from three different sources that can carry untrusted data: the DBI_PROFILE environment variable, a direct attribute assignment, and a DSN driver-attribute clause dbi:Driver(Profile=>SPEC):db.\n\nAn attacker controlling any of those inputs runs arbitrary Perl in the host process. The strongest remote position is a network-exposed DBI::Gofer / DBI::ProxyServer whose per-request DSN reaches the Profile attribute, letting a client execute code on the broker host.\n    "}], "providerMetadata": {"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "shortName": "suse", "dateUpdated": "2026-07-17T00:00:00Z", "x_subShortName": "suse_server_16"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "amazon", "product": "perl-DBI", "versions": [{"status": "affected", "version": "0", "lessThan": "1.627-4.amzn2.0.4", "versionType": "rpm"}], "defaultStatus": "unaffected"}, {"vendor": "amazon", "product": "perl-DBI-debuginfo", "versions": [{"status": "affected", "version": "0", "lessThan": "1.627-4.amzn2.0.4", "versionType": "rpm"}], "defaultStatus": "unaffected"}], "references": [{"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14380"}], "descriptions": [{"lang": "en", "value": "DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile."}], "providerMetadata": {"orgId": "00000000-0000-4000-A000-000000000000", "shortName": "alas", "dateUpdated": "2026-07-20T09:00:00Z", "x_subShortName": "alas_2"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "amazon", "product": "perl-DBI", "versions": [{"status": "affected", "version": "0", "lessThan": "1.650-1.amzn2023.0.1", "versionType": "rpm"}], "defaultStatus": "unaffected"}, {"vendor": "amazon", "product": "perl-DBI-debuginfo", "versions": [{"status": "affected", "version": "0", "lessThan": "1.650-1.amzn2023.0.1", "versionType": "rpm"}], "defaultStatus": "unaffected"}, {"vendor": "amazon", "product": "perl-DBI-debugsource", "versions": [{"status": "affected", "version": "0", "lessThan": "1.650-1.amzn2023.0.1", "versionType": "rpm"}], "defaultStatus": "unaffected"}, {"vendor": "amazon", "product": "perl-DBI-tests", "versions": [{"status": "affected", "version": "0", "lessThan": "1.650-1.amzn2023.0.1", "versionType": "rpm"}], "defaultStatus": "unaffected"}], "references": [{"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14380"}], "descriptions": [{"lang": "en", "value": "DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile."}], "providerMetadata": {"orgId": "00000000-0000-4000-A000-000000000000", "shortName": "alas", "dateUpdated": "2026-07-20T09:00:00Z", "x_subShortName": "alas_2023"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "Unknown", "content": {"data": "{\"description\":\"medium\"}"}}}], "affected": [{"vendor": "canonical", "product": "libdbi-perl", "platforms": ["bionic", "focal", "jammy", "noble", "resolute", "trusty", "xenial"], "defaultStatus": "unknown"}], "references": [{"url": "https://ubuntu.com/security/CVE-2026-14380"}, {"url": "https://www.cve.org/CVERecord?id=CVE-2026-14380"}], "descriptions": [{"lang": "en", "value": "DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile. When a string is assigned to a DBI handle's Profile attribute, DBI splits it into path, package and arguments, and interpolates the package part in a string eval with no validation of the package name. Any caller-influenced value that reaches the Profile attribute is therefore arbitrary Perl code execution, including calls to run system commands. The Profile attribute can be set from three different sources that can carry untrusted data: the DBI_PROFILE environment variable, a direct attribute assignment, and a DSN driver-attribute clause dbi:Driver(Profile=>SPEC):db. An attacker controlling any of those inputs runs arbitrary Perl in the host process. The strongest remote position is a network-exposed DBI::Gofer / DBI::ProxyServer whose per-request DSN reaches the Profile attribute, letting a client execute code on the broker host."}], "providerMetadata": {"orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "shortName": "canonical", "dateUpdated": "2026-07-07T23:16:00Z", "x_subShortName": "canonical"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "Unknown", "content": {"data": "{\"description\":\"Important\"}"}}}], "affected": [{"vendor": "unknown", "product": "unknown", "defaultStatus": "unknown"}], "solutions": [{"lang": "en", "value": "SUSE bug 1271018"}, {"lang": "en", "value": "SUSE bug 1279550"}], "references": [{"url": "https://lists.suse.com/pipermail/suse-liberty-linux-updates/2026-August/007386.html", "name": "ESSA-2026:0151"}, {"url": "https://lists.suse.com/pipermail/suse-liberty-linux-updates/2026-August/007387.html", "name": "ESSA-2026:0152"}, {"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14380", "name": "Mitre CVE-2026-14380"}, {"url": "https://lists.suse.com/pipermail/suse-liberty-linux-updates/2026-August/007312.html", "name": "RHSA-2026:49514"}, {"url": "https://lists.suse.com/pipermail/suse-liberty-linux-updates/2026-August/007333.html", "name": "RHSA-2026:49612"}, {"url": "https://lists.suse.com/pipermail/suse-liberty-linux-updates/2026-September/007696.html", "name": "RHSA-2026:62667"}, {"url": "https://www.suse.com/security/cve/CVE-2026-14380", "name": "SUSE CVE-2026-14380"}, {"url": "https://lists.suse.com/pipermail/sle-updates/2026-July/048281.html", "name": "SUSE-SU-2026:22592-1"}, {"url": "https://lists.suse.com/pipermail/sle-updates/2026-July/048389.html", "name": "SUSE-SU-2026:22623-1"}, {"url": "https://lists.suse.com/pipermail/sle-security-updates/2026-July/027949.html", "name": "SUSE-SU-2026:3283-1"}, {"url": "https://lists.suse.com/pipermail/sle-updates/2026-July/048963.html", "name": "SUSE-SU-2026:3415-1"}, {"url": "https://lists.suse.com/pipermail/sle-updates/2026-August/049046.html", "name": "SUSE-SU-2026:3461-1"}], "descriptions": [{"lang": "en", "value": "\n    DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile.\n\nWhen a string is assigned to a DBI handle's Profile attribute, DBI splits it into path, package and arguments, and interpolates the package part in a string eval with no validation of the package name.\n\nAny caller-influenced value that reaches the Profile attribute is therefore arbitrary Perl code execution, including calls to run system commands.\n\nThe Profile attribute can be set from three different sources that can carry untrusted data: the DBI_PROFILE environment variable, a direct attribute assignment, and a DSN driver-attribute clause dbi:Driver(Profile=>SPEC):db.\n\nAn attacker controlling any of those inputs runs arbitrary Perl in the host process. The strongest remote position is a network-exposed DBI::Gofer / DBI::ProxyServer whose per-request DSN reaches the Profile attribute, letting a client execute code on the broker host.\n    "}], "providerMetadata": {"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "shortName": "suse", "dateUpdated": "2026-08-04T00:00:00Z", "x_subShortName": "suse_server_12"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"cpes": ["cpe:2.3:a:perl:dbi:*:*:*:*:*:*:*:*"], "vendor": "perl", "product": "dbi", "versions": [{"status": "affected", "version": "0", "lessThan": "1.650", "versionType": "custom"}], "defaultStatus": "unaffected"}], "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/07/07/16", "tags": ["mailing-list", "patch", "third-party-advisory"]}, {"url": "https://github.com/perl5-dbi/dbi/commit/b73d5d9901767fc1d16b6661ef08fbed4532e259.patch", "tags": ["patch"]}, {"url": "https://metacpan.org/release/HMBRAND/DBI-1.650/changes", "tags": ["release-notes"]}, {"url": "https://github.com/perl5-dbi/dbi/security/advisories/GHSA-ch8w-hxc2-v557", "tags": ["vendor-advisory"]}], "descriptions": [{"lang": "en", "value": "DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile.\n\nWhen a string is assigned to a DBI handle's Profile attribute, DBI splits it into path, package and arguments, and interpolates the package part in a string eval with no validation of the package name.\n\nAny caller-influenced value that reaches the Profile attribute is therefore arbitrary Perl code execution, including calls to run system commands.\n\nThe Profile attribute can be set from three different sources that can carry untrusted data: the DBI_PROFILE environment variable, a direct attribute assignment, and a DSN driver-attribute clause dbi:Driver(Profile=>SPEC):db.\n\nAn attacker controlling any of those inputs runs arbitrary Perl in the host process. The strongest remote position is a network-exposed DBI::Gofer / DBI::ProxyServer whose per-request DSN reaches the Profile attribute, letting a client execute code on the broker host."}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-470", "description": "CWE-470"}, {"lang": "en", "cweId": "CWE-95", "description": "CWE-95"}]}], "providerMetadata": {"orgId": "00000000-0000-4000-A000-000000000003", "shortName": "nvd", "dateUpdated": "2026-07-07T23:16:53Z", "x_subShortName": "nvd"}}}, "cveMetadata": {"cveId": "CVE-2026-14380", "state": "PUBLISHED", "dateUpdated": "2026-08-31T10:16:48Z", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "datePublished": "2026-07-07T23:16:53Z", "assignerShortName": "CPANSec"}, "dataVersion": "5.0"}