DBI (Product): news timeline & CVEs

CVE-2026-88816: DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in FetchHashKeyName

CVE-2026-88816: Perl DBI before 1.654 treats numeric FetchHashKeyName values as strings.

Robert Rothenberg posted CVE-2026-88816 to oss-security. Perl DBI versions before 1.654 incorrectly treat numeric values as strings in FetchHashKeyName. The report references the DBI distribution on MetaCPAN and the perl5-dbi GitHub repository. The available text does not say the flaw is being exploited.

oss-securitySep 28, 17:15 UTC · 18d agoVulnerability 3 sources CVE-2026-888161· 1 read

CVE-2026-78030: DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM

Perl DBI before 1.653 loads arbitrary modules via unvalidated DBD::DBM dbm_type and dbm_mldbm attributes, enabling code execution with attacker-controlled attributes.

CVE-2026-78030 affects the Perl DBI database interface in all versions before 1.653. The DBD::DBM driver does not validate the dbm_type and dbm_mldbm attributes before using them to load Perl modules, so applications that pass attacker-controlled attributes to DBI connect can be made to load arbitrary modules, which can lead to code execution. Robert Rothenberg disclosed the flaw on the oss-security mailing list on September 19, 2026; users should upgrade to DBI 1.653.

oss-securitySep 19, 16:14 UTC · 27d agoVulnerability CVE-2026-780302· 1 read

DBI

Timeline2 articles

Related CVEsby mentions

Appears with

CVE-2026-88816: DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in FetchHashKeyName

CVE-2026-78030: DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM