Vulnerability-Lookup

OPENSUSE-SU-2026:12201-1

Vulnerability from csaf_opensuse - Published: 2026-10-20 00:00 - Updated: 2026-10-21 19:07

Summary

perl-DBI-1.656.0-1.1 on GA media

Severity

Moderate

Notes

Title of the patch: perl-DBI-1.656.0-1.1 on GA media

Description of the patch: These are all security issues fixed in the perl-DBI-1.656.0-1.1 package on the GA media of openSUSE Tumbleweed.

Patchnames: openSUSE-Tumbleweed-2026-12201

CVE-2026-108518

4.7 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 4 products

Product	Version	Remediation
Unresolved product id: openSUSE Tumbleweed:perl-DBI-0:1.656.0-1.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:perl-DBI-0:1.656.0-1.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:perl-DBI-0:1.656.0-1.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:perl-DBI-0:1.656.0-1.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2026-111879

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 4 products, the same list as for CVE-2026-108518

Threats

Impact important

References

8 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/o…	self
https://www.suse.com/security/cve/CVE-2026-108518/	self
https://www.suse.com/security/cve/CVE-2026-111879/	self
https://www.suse.com/security/cve/CVE-2026-108518	external
https://bugzilla.suse.com/1286552	external
https://www.suse.com/security/cve/CVE-2026-111879	external
https://bugzilla.suse.com/1286553	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "perl-DBI-1.656.0-1.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the perl-DBI-1.656.0-1.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2026-12201",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_12201-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-108518 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-108518/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-111879 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-111879/"
      }
    ],
    "title": "perl-DBI-1.656.0-1.1 on GA media",
    "tracking": {
      "current_release_date": "2026-10-21T19:07:09Z",
      "generator": {
        "date": "2026-10-20T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:12201-1",
      "initial_release_date": "2026-10-20T00:00:00Z",
      "revision_history": [
        {
          "date": "2026-10-20T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-10-21T11:53:00Z",
          "number": "2",
          "summary": "unknown changes"
        },
        {
          "date": "2026-10-21T19:07:09Z",
          "number": "3",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "perl-DBI-0:1.656.0-1.1.aarch64",
                "product": {
                  "name": "perl-DBI-0:1.656.0-1.1.aarch64",
                  "product_id": "perl-DBI-0:1.656.0-1.1.aarch64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:perl:database_interface:1.656.0:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/perl-DBI@1.656.0-1.1?arch=aarch64\u0026upstream=perl-DBI-0:1.656.0-1.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "perl-DBI-0:1.656.0-1.1.ppc64le",
                "product": {
                  "name": "perl-DBI-0:1.656.0-1.1.ppc64le",
                  "product_id": "perl-DBI-0:1.656.0-1.1.ppc64le",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:perl:database_interface:1.656.0:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/perl-DBI@1.656.0-1.1?arch=ppc64le\u0026upstream=perl-DBI-0:1.656.0-1.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "perl-DBI-0:1.656.0-1.1.s390x",
                "product": {
                  "name": "perl-DBI-0:1.656.0-1.1.s390x",
                  "product_id": "perl-DBI-0:1.656.0-1.1.s390x",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:perl:database_interface:1.656.0:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/perl-DBI@1.656.0-1.1?arch=s390x\u0026upstream=perl-DBI-0:1.656.0-1.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "perl-DBI-0:1.656.0-1.1.x86_64",
                "product": {
                  "name": "perl-DBI-0:1.656.0-1.1.x86_64",
                  "product_id": "perl-DBI-0:1.656.0-1.1.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:perl:database_interface:1.656.0:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/perl-DBI@1.656.0-1.1?arch=x86_64\u0026upstream=perl-DBI-0:1.656.0-1.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "perl-DBI-0:1.656.0-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:perl-DBI-0:1.656.0-1.1.aarch64"
        },
        "product_reference": "perl-DBI-0:1.656.0-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "perl-DBI-0:1.656.0-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:perl-DBI-0:1.656.0-1.1.ppc64le"
        },
        "product_reference": "perl-DBI-0:1.656.0-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "perl-DBI-0:1.656.0-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:perl-DBI-0:1.656.0-1.1.s390x"
        },
        "product_reference": "perl-DBI-0:1.656.0-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "perl-DBI-0:1.656.0-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:perl-DBI-0:1.656.0-1.1.x86_64"
        },
        "product_reference": "perl-DBI-0:1.656.0-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-108518",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-108518"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "DBI versions before 1.656 for Perl crash via type confusion in dbi_profile when a database handle is destroyed under a Profile Path with an {attr} element.\n\nAn {attr} element names a database handle attribute, which dbi_profile reads from the handle\u0027s inner hash. It expects the inner handle as a reference and dereferences it, but a handle that is being destroyed hands back the inner hash itself, so the dereference yields the hash\u0027s bucket array. A type check on that pointer usually fails and the call goes unprofiled. When the memory it addresses passes the check, the attribute lookup dereferences a NULL or invalid pointer and the process dies on SIGSEGV.\n\nThe Path is set by the application, by the Profile handle attribute, or by the DBI_PROFILE environment variable, so `DBI_PROFILE={ImplementorClass}` can crash an unmodified program.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:perl-DBI-0:1.656.0-1.1.aarch64",
          "openSUSE Tumbleweed:perl-DBI-0:1.656.0-1.1.ppc64le",
          "openSUSE Tumbleweed:perl-DBI-0:1.656.0-1.1.s390x",
          "openSUSE Tumbleweed:perl-DBI-0:1.656.0-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-108518",
          "url": "https://www.suse.com/security/cve/CVE-2026-108518"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1286552 for CVE-2026-108518",
          "url": "https://bugzilla.suse.com/1286552"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:perl-DBI-0:1.656.0-1.1.aarch64",
            "openSUSE Tumbleweed:perl-DBI-0:1.656.0-1.1.ppc64le",
            "openSUSE Tumbleweed:perl-DBI-0:1.656.0-1.1.s390x",
            "openSUSE Tumbleweed:perl-DBI-0:1.656.0-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:perl-DBI-0:1.656.0-1.1.aarch64",
            "openSUSE Tumbleweed:perl-DBI-0:1.656.0-1.1.ppc64le",
            "openSUSE Tumbleweed:perl-DBI-0:1.656.0-1.1.s390x",
            "openSUSE Tumbleweed:perl-DBI-0:1.656.0-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-20T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-108518"
    },
    {
      "cve": "CVE-2026-111879",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-111879"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "DBI versions before 1.656 for Perl hang on a later open of a DBD::DBM table because a failed open_data does not release the table\u0027s lock.\n\nopen_data creates the table\u0027s lock file and takes an exclusive flock on it for a CREATE, before the checks that can croak: a dbm_mldbm value that is not a module name, a failing tie, or a missing data file. The croak unwinds before the table object is blessed, so nothing releases the lock, and the meta data holding the open descriptor stays cached on the database handle.\n\nThe dbm_mldbm and dbm_type values come from the DSN or the connect attributes, so a caller that chooses the serializer or the storage backend can trigger the failure.\n\nThe flock has no timeout, so a later open of that table (even through a separate database handle) blocks for as long as the handle holding the stale lock lives, in the same process or any other.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:perl-DBI-0:1.656.0-1.1.aarch64",
          "openSUSE Tumbleweed:perl-DBI-0:1.656.0-1.1.ppc64le",
          "openSUSE Tumbleweed:perl-DBI-0:1.656.0-1.1.s390x",
          "openSUSE Tumbleweed:perl-DBI-0:1.656.0-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-111879",
          "url": "https://www.suse.com/security/cve/CVE-2026-111879"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1286553 for CVE-2026-111879",
          "url": "https://bugzilla.suse.com/1286553"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:perl-DBI-0:1.656.0-1.1.aarch64",
            "openSUSE Tumbleweed:perl-DBI-0:1.656.0-1.1.ppc64le",
            "openSUSE Tumbleweed:perl-DBI-0:1.656.0-1.1.s390x",
            "openSUSE Tumbleweed:perl-DBI-0:1.656.0-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:perl-DBI-0:1.656.0-1.1.aarch64",
            "openSUSE Tumbleweed:perl-DBI-0:1.656.0-1.1.ppc64le",
            "openSUSE Tumbleweed:perl-DBI-0:1.656.0-1.1.s390x",
            "openSUSE Tumbleweed:perl-DBI-0:1.656.0-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-20T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-111879"
    }
  ]
}

CVE-2026-108518 (GCVE-0-2026-108518)

Vulnerability from cvelistv5 – Published: 2026-10-20 21:23 – Updated: 2026-10-21 00:17

Title

DBI versions before 1.656 for Perl crash via type confusion in dbi_profile when a database handle is destroyed under a Profile Path with an {attr} element

Summary

DBI versions before 1.656 for Perl crash via type confusion in dbi_profile when a database handle is destroyed under a Profile Path with an {attr} element. An {attr} element names a database handle attribute, which dbi_profile reads from the handle's inner hash. It expects the inner handle as a reference and dereferences it, but a handle that is being destroyed hands back the inner hash itself, so the dereference yields the hash's bucket array. A type check on that pointer usually fails and the call goes unprofiled. When the memory it addresses passes the check, the attribute lookup dereferences a NULL or invalid pointer and the process dies on SIGSEGV. The Path is set by the application, by the Profile handle attribute, or by the DBI_PROFILE environment variable, so `DBI_PROFILE={ImplementorClass}` can crash an unmodified program.

Severity

No CVSS data available.

CWE

CWE-843 - Access of Resource Using Incompatible Type ('Type Confusion')

Assigner

CPANSec CNA under the redhat root

CNA scorecard C 63/100 over 296 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/perl5-dbi/dbi/security/advisor…	vendor-advisory
https://github.com/perl5-dbi/dbi/commit/c2ff4df57…	patch
https://metacpan.org/release/HMBRAND/DBI-1.656/changes	release-notes
http://www.openwall.com/lists/oss-security/2026/1…

Impacted products

1 product

Vendor	Product	Version
		Affected: 0 , < 1.656 (custom)

Credits

Henrik Teichmann

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-10-21T00:17:16.110Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/10/20/37"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://cpan.org/modules",
          "defaultStatus": "unaffected",
          "modules": [
            "DBI"
          ],
          "packageName": "DBI",
          "packageURL": "pkg:cpan/DBI",
          "programFiles": [
            "DBI.xs"
          ],
          "programRoutines": [
            {
              "name": "dbi_profile"
            }
          ],
          "repo": "https://github.com/perl5-dbi/dbi",
          "versions": [
            {
              "lessThan": "1.656",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Henrik Teichmann"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "DBI versions before 1.656 for Perl crash via type confusion in dbi_profile when a database handle is destroyed under a Profile Path with an {attr} element.\n\nAn {attr} element names a database handle attribute, which dbi_profile reads from the handle\u0027s inner hash. It expects the inner handle as a reference and dereferences it, but a handle that is being destroyed hands back the inner hash itself, so the dereference yields the hash\u0027s bucket array. A type check on that pointer usually fails and the call goes unprofiled. When the memory it addresses passes the check, the attribute lookup dereferences a NULL or invalid pointer and the process dies on SIGSEGV.\n\nThe Path is set by the application, by the Profile handle attribute, or by the DBI_PROFILE environment variable, so `DBI_PROFILE={ImplementorClass}` can crash an unmodified program."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-843",
              "description": "CWE-843 Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-20T21:23:13.373Z",
        "orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
        "shortName": "CPANSec"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/perl5-dbi/dbi/security/advisories/GHSA-7393-6f8r-fhh3"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/perl5-dbi/dbi/commit/c2ff4df575d7af625bb4d0d1ef7539f90b22d8b2.patch"
        },
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://metacpan.org/release/HMBRAND/DBI-1.656/changes"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to DBI 1.656 or later."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "DBI versions before 1.656 for Perl crash via type confusion in dbi_profile when a database handle is destroyed under a Profile Path with an {attr} element",
      "x_generator": {
        "engine": "cpansec-cna-tool 0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
    "assignerShortName": "CPANSec",
    "cveId": "CVE-2026-108518",
    "datePublished": "2026-10-20T21:23:13.373Z",
    "dateReserved": "2026-10-10T09:59:45.173Z",
    "dateUpdated": "2026-10-21T00:17:16.110Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-111879 (GCVE-0-2026-111879)

Vulnerability from cvelistv5 – Published: 2026-10-20 21:24 – Updated: 2026-10-21 00:17

Title

DBI versions before 1.656 for Perl hang on a later open of a DBD::DBM table because a failed open_data does not release the table's lock

Summary

DBI versions before 1.656 for Perl hang on a later open of a DBD::DBM table because a failed open_data does not release the table's lock. open_data creates the table's lock file and takes an exclusive flock on it for a CREATE, before the checks that can croak: a dbm_mldbm value that is not a module name, a failing tie, or a missing data file. The croak unwinds before the table object is blessed, so nothing releases the lock, and the meta data holding the open descriptor stays cached on the database handle. The dbm_mldbm and dbm_type values come from the DSN or the connect attributes, so a caller that chooses the serializer or the storage backend can trigger the failure. The flock has no timeout, so a later open of that table (even through a separate database handle) blocks for as long as the handle holding the stale lock lives, in the same process or any other.

Severity

No CVSS data available.

CWE

CWE-667 - Improper Locking

Assigner

CPANSec CNA under the redhat root

CNA scorecard C 63/100 over 296 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/perl5-dbi/dbi/security/advisor…	vendor-advisory
https://github.com/perl5-dbi/dbi/commit/99bbf2ab9…	patch
https://metacpan.org/release/HMBRAND/DBI-1.656/changes	release-notes
http://www.openwall.com/lists/oss-security/2026/1…

Impacted products

1 product

Vendor	Product	Version
		Affected: 0 , < 1.656 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-10-21T00:17:17.176Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/10/20/38"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://cpan.org/modules",
          "defaultStatus": "unaffected",
          "modules": [
            "DBI"
          ],
          "packageName": "DBI",
          "packageURL": "pkg:cpan/DBI",
          "programFiles": [
            "lib/DBD/DBM.pm",
            "lib/DBD/File.pm"
          ],
          "programRoutines": [
            {
              "name": "DBD::DBM::Table::open_data"
            },
            {
              "name": "DBD::File::DataSource::File::open_data"
            }
          ],
          "repo": "https://github.com/perl5-dbi/dbi",
          "versions": [
            {
              "lessThan": "1.656",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "DBI versions before 1.656 for Perl hang on a later open of a DBD::DBM table because a failed open_data does not release the table\u0027s lock.\n\nopen_data creates the table\u0027s lock file and takes an exclusive flock on it for a CREATE, before the checks that can croak: a dbm_mldbm value that is not a module name, a failing tie, or a missing data file. The croak unwinds before the table object is blessed, so nothing releases the lock, and the meta data holding the open descriptor stays cached on the database handle.\n\nThe dbm_mldbm and dbm_type values come from the DSN or the connect attributes, so a caller that chooses the serializer or the storage backend can trigger the failure.\n\nThe flock has no timeout, so a later open of that table (even through a separate database handle) blocks for as long as the handle holding the stale lock lives, in the same process or any other."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-667",
              "description": "CWE-667 Improper Locking",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-20T21:24:00.036Z",
        "orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
        "shortName": "CPANSec"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/perl5-dbi/dbi/security/advisories/GHSA-8cx8-9vj9-9x7j"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/perl5-dbi/dbi/commit/99bbf2ab9d137e6f042a770bd3bbba3bc0b3a901.patch"
        },
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://metacpan.org/release/HMBRAND/DBI-1.656/changes"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to DBI 1.656 or later."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "DBI versions before 1.656 for Perl hang on a later open of a DBD::DBM table because a failed open_data does not release the table\u0027s lock",
      "x_generator": {
        "engine": "cpansec-cna-tool 0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
    "assignerShortName": "CPANSec",
    "cveId": "CVE-2026-111879",
    "datePublished": "2026-10-20T21:24:00.036Z",
    "dateReserved": "2026-10-17T11:40:00.659Z",
    "dateUpdated": "2026-10-21T00:17:17.176Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

OPENSUSE-SU-2026:12201-1

CVE-2026-108518 (GCVE-0-2026-108518)

CVE-2026-111879 (GCVE-0-2026-111879)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour