CVE-2026-60081

EUVD-2026-43728
DBI::ProfileData versions before 1.651 for Perl do not limit the path index.

The path index column of profile dump files is used to allocate an array of data for the parser. An unbounded value allows an attacker to specify a large index and consume available memory.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 29.22%
Debian logo
Debian Releases
Debian Product
Codename
libdbi-perl
bookworm
vulnerable
bookworm (security)
vulnerable
bullseye
vulnerable
bullseye (security)
vulnerable
forky
1.651-1
fixed
sid
1.652-2
fixed
trixie
no-dsa
trixie (security)
vulnerable
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
libdbi-perl
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
resolute
needs-triage
trusty
needs-triage
xenial
needs-triage
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
perl-DBI
Amazon Linux 2
0:1.627-4.amzn2.0.6
fixed
Amazon Linux 2023
0:1.651-1.amzn2023.0.1
fixed
perl-DBI-debuginfo
Amazon Linux 2
0:1.627-4.amzn2.0.6
fixed
Amazon Linux 2023
0:1.651-1.amzn2023.0.1
fixed
perl-DBI-debugsource
Amazon Linux 2023
0:1.651-1.amzn2023.0.1
fixed
perl-DBI-tests
Amazon Linux 2023
0:1.651-1.amzn2023.0.1
fixed
Azure Linux logo
Azure Linux Releases
Azure Package
Release
perl-DBI
Azure Linux 3.0
0:1.651-1.azl3
fixed
Common Weakness Enumeration
Vulnerability Media Exposure
References
https://github.com/perl5-dbi/dbi/commit/6764e755e83ee1ebb1b40760e5b53eb50960bd7a.patch
https://github.com/perl5-dbi/dbi/security/advisories/GHSA-ww49-w4mv-jrr4
https://metacpan.org/release/HMBRAND/DBI-1.651/changes
http://www.openwall.com/lists/oss-security/2026/07/14/14