DBI before 1.656 can hang after failed DBD::DBM open (CVE-2026-111879)
Original title: CVE-2026-111879: DBI versions before 1.656 for Perl hang on a later open of a DBD::DBM table because a failed open_data does not release the table's lock
A failed open_data leaves the table lock held, so a later open hangs.
Robert Rothenberg reported that Perl DBI before 1.656 can hang when a DBD::DBM table is opened again after a failed open. The failed open_data call does not release the table lock. The short feed post does not describe exploitation or confirm a fix version.
Unconfirmed: The snippet does not confirm that 1.656 contains the fix or that the hang has been exploited.
- The issue is CVE-2026-111879.
- It affects the DBD::DBM table open path.
- The report links to the perl5-dbi GitHub repository and MetaCPAN.
Impact: A later open of the same DBD::DBM table hangs
| Product | Affected |
|---|---|
| DBI | before 1.656 |
- 1.Upgrade DBI to a release that is not before 1.656.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111879 | DBI versions before 1.656 for Perl hang on a later open of a DBD::DBM table because a failed open_data does not release the table's lock | 6.5 | — |
From the original article
Posted by Robert Rothenberg on Oct 20 ======================================================================== https://metacpan. org/dist/DBI https://github. com/perl5-dbi/dbi DBI...
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.