RHSA-2026:49514HighCVSS 8.8

Red Hat Security Advisory: perl-DBI security update

Published
August 3, 2026
Last Modified
August 3, 2026

🔗 CVE IDs covered (2)

CVE-2026-14380 →CVE-2026-14739 →

📋 Description

CVE-2026-14380 — DBI: DBI: Arbitrary code execution via caller-influenced Profile attribute CVE-2026-14739 — DBI: DBI: Heap overflow when preparsing SQL statements with excessive placeholders

🎯 Affected products14

  • Red Hat Enterprise Linux AppStream (v. 10)
  • perl-DBI-0:1.643-26.el10_2.3.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • perl-DBI-0:1.643-26.el10_2.3.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • perl-DBI-0:1.643-26.el10_2.3.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • perl-DBI-0:1.643-26.el10_2.3.src as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • perl-DBI-0:1.643-26.el10_2.3.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • perl-DBI-debuginfo-0:1.643-26.el10_2.3.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • perl-DBI-debuginfo-0:1.643-26.el10_2.3.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • perl-DBI-debuginfo-0:1.643-26.el10_2.3.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • perl-DBI-debuginfo-0:1.643-26.el10_2.3.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • perl-DBI-debugsource-0:1.643-26.el10_2.3.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • perl-DBI-debugsource-0:1.643-26.el10_2.3.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • perl-DBI-debugsource-0:1.643-26.el10_2.3.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • perl-DBI-debugsource-0:1.643-26.el10_2.3.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: To reduce the risk of arbitrary code execution, avoid setting the `DBI_PROFILE` environment variable from untrusted sources. Ensure that DSN driver-attribute clauses, particularly those used with `dbi:Driver(Profile=>SPEC):db`, are not populated with unvalidated or untrusted input. Workaround: Applications utilizing `perl-DBI` should implement robust input validation and limit the number of parameters used in SQL query placeholders, particularly when processing untrusted data. This operational control can prevent the construction of SQL statements with an excessive number of placeholders, thereby reducing the risk of triggering the heap overflow vulnerability.

🔗 References (5)