CVE-2026-14380
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
Vulnerability in DBI for Perl before version 1.650 allows code injection via the Profile attribute, which is interpolated in eval without validation. An attacker can control Profile through the DBI_PROFILE environment variable, direct assignment, or DSN clause, leading to arbitrary Perl code execution.
Risk Assessment
Risk for the organization includes remote code execution on the server, especially in DBI::Gofer or DBI::ProxyServer, where a client can send a malicious DSN and take over the broker host.
Recommendation
Immediately update DBI to version 1.650 or later. Restrict access to the DBI_PROFILE environment variable and avoid using untrusted data in the Profile attribute.
Other vulnerabilities in DBI
See all- CVE-2026-73194Critical
In DBI for Perl before version 1.652, a heap out-of-bounds write occurs via an unvalidated numeric placeholder that sets the binder counter in preparse. A crafted statement can cause a write beyond the allocated buffer.
- CVE-2026-73193Critical
In DBI for Perl before version 1.652, a heap out-of-bounds write occurs on 32-bit Perl due to integer wraparound in the output buffer size computed by preparse. A very long statement can cause a write beyond the allocated buffer.
- CVE-2026-60082Critical
A vulnerability in the DBI library for Perl before version 1.651 does not enforce statement handle consistency with the row. When the statement handle had no fields but the source row was non-empty, the internal row-buffer helper would read from a negative array index.
- CVE-2026-14740Critical
A vulnerability in the DBI library for Perl before version 1.650 causes an out-of-bounds read by one byte during processing of an initial SQL comment in the preparse method. The issue occurs when deleting a comment at the beginning of an SQL query.
- CVE-2026-14739Critical
A heap overflow vulnerability in DBI versions before 1.650 for Perl occurs when preparsing SQL statements with an extreme number of placeholders. The fix for CVE-2026-10879 did not allocate enough memory to handle approximately 1.2 million placeholders. Version 1.650 sets a hard limit of 99,999 placeholders.
- CVE-2026-9698Critical
DBI for Perl before version 1.648 saves error messages in a limited-size buffer (200 bytes) without length control. Attackers who can influence error text may cause a buffer overflow.
- CVE-2026-19546High
A flaw was found in DBI, which is a fix for a partial fix for CVE-2026-14380 for RHEL 9.8.z and 10.2.z. Detailed information is available in the original description on the Red Hat website.
Original NVD description (English source)
DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile. When a string is assigned to a DBI handle's Profile attribute, DBI splits it into path, package and arguments, and interpolates the package part in a string eval with no validation of the package name. Any caller-influenced value that reaches the Profile attribute is therefore arbitrary Perl code execution, including calls to run system commands. The Profile attribute can be set from three different sources that can carry untrusted data: the DBI_PROFILE environment variable, a direct attribute assignment, and a DSN driver-attribute clause dbi:Driver(Profile=>SPEC):db. An attacker controlling any of those inputs runs arbitrary Perl in the host process. The strongest remote position is a network-exposed DBI::Gofer / DBI::ProxyServer whose per-request DSN reaches the Profile attribute, letting a client execute code on the broker host.