DBI up to 1.655 dbi_profile type confusion

Summaryinfo

A vulnerability was found in DBI up to 1.655. It has been classified as critical. Affected by this issue is some unknown functionality of the component dbi_profile. This manipulation causes type confusion. The identification of this vulnerability is CVE-2026-108518. It is possible to initiate the attack remotely. There is no exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability has been found in DBI up to 1.655 and classified as critical. Affected by this vulnerability is an unknown code block of the component dbi_profile. The manipulation with an unknown input leads to a type confusion vulnerability. The CWE definition for the vulnerability is CWE-843. The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

DBI versions before 1.656 for Perl crash via type confusion in dbi_profile when a database handle is destroyed under a Profile Path with an {attr} element. An {attr} element names a database handle attribute, which dbi_profile reads from the handle's inner hash. It expects the inner handle as a reference and dereferences it, but a handle that is being destroyed hands back the inner hash itself, so the dereference yields the hash's bucket array. A type check on that pointer usually fails and the call goes unprofiled. When the memory it addresses passes the check, the attribute lookup dereferences a NULL or invalid pointer and the process dies on SIGSEGV. The Path is set by the application, by the Profile handle attribute, or by the DBI_PROFILE environment variable, so `DBI_PROFILE={ImplementorClass}` can crash an unmodified program.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-108518 since 10/10/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Neither technical details nor an exploit are publicly available.

Upgrading to version 1.656 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Name

• DBI

Version

• 1.655

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion