DBI before 1.656 crashes on profile type confusion (CVE-2026-108518)
Original title: CVE-2026-108518: DBI versions before 1.656 for Perl crash via type confusion in dbi_profile when a database handle is destroyed under a Profile Path with an {attr} element
Destroying a handle under a Profile Path containing an {attr} element confuses types in dbi_profile.
Robert Rothenberg reported a crash in Perl DBI before 1.656. Type confusion in dbi_profile occurs when a database handle is destroyed while a Profile Path includes an {attr} element. The truncated post does not say whether the crash is exploitable beyond denial of service.
Unconfirmed: The snippet does not confirm the fixed version or any real-world exploitation.
- The flaw is CVE-2026-108518.
- The crash is tied to Profile Path handling during handle destruction.
- The announcement points to MetaCPAN and the perl5-dbi GitHub project.
Impact: Process crash through type confusion in dbi_profile
| Product | Affected |
|---|---|
| DBI | before 1.656 |
- 1.Upgrade DBI to a release that is not before 1.656.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-108518 | DBI versions before 1.656 for Perl crash via type confusion in dbi_profile when a database handle is destroyed under a Profile Path with an {attr} element | 2.9 | — |
From the original article
Posted by Robert Rothenberg on Oct 20 ======================================================================== https://metacpan. org/dist/DBI https://github. com/perl5-dbi/dbi DBI...
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.