RHSA-2026:62667HighCVSS 8.8

Red Hat Security Advisory: perl-DBI security update

Published
September 2, 2026
Last Modified
November 4, 2026

🔗 CVE IDs covered (4)

CVE-2026-9698 →CVE-2026-10879 →CVE-2026-14380 →CVE-2026-14739 →

📋 Description

CVE-2026-9698 — DBI: DBI: Buffer overflow in error handling can lead to arbitrary code execution CVE-2026-10879 — perl-DBI: perl-DBI: Heap overflow in SQL preparsing can lead to denial of service or arbitrary code execution. CVE-2026-14380 — DBI: DBI: Arbitrary code execution via caller-influenced Profile attribute CVE-2026-14739 — DBI: DBI: Heap overflow when preparsing SQL statements with excessive placeholders

🎯 Affected products11

  • Red Hat Enterprise Linux BaseOS (v. 8)
  • perl-DBI-0:1.641-2.el8_10.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • perl-DBI-0:1.641-2.el8_10.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • perl-DBI-0:1.641-2.el8_10.src as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • perl-DBI-0:1.641-2.el8_10.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • perl-DBI-debuginfo-0:1.641-2.el8_10.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • perl-DBI-debuginfo-0:1.641-2.el8_10.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • perl-DBI-debuginfo-0:1.641-2.el8_10.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • perl-DBI-debugsource-0:1.641-2.el8_10.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • perl-DBI-debugsource-0:1.641-2.el8_10.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • perl-DBI-debugsource-0:1.641-2.el8_10.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Users are advised to identify network-accessible applications which use perl-DBI and ensure that only trusted users have access to those applications. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To reduce the risk of arbitrary code execution, avoid setting the `DBI_PROFILE` environment variable from untrusted sources. Ensure that DSN driver-attribute clauses, particularly those used with `dbi:Driver(Profile=>SPEC):db`, are not populated with unvalidated or untrusted input. Workaround: Applications utilizing `perl-DBI` should implement robust input validation and limit the number of parameters used in SQL query placeholders, particularly when processing untrusted data. This operational control can prevent the construction of SQL statements with an excessive number of placeholders, thereby reducing the risk of triggering the heap overflow vulnerability.

🔗 References (7)