{"id":"CVE-2026-108518","aliases":[],"cve":{"records":[{"id":"CVE-2026-108518","source":"CPANSec","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-10T09:59:45.173Z","published":"2026-10-20T21:23:13.373Z","modified":"2026-10-30T12:48:49.541Z"}],"publishers":[{"name":"CPANSec","role":"CNA","organizationId":"9b29abf9-4ab0-4765-b253-1875cd9b441e","modified":"2026-10-20T21:23:13.373Z"},{"name":"CVE","role":"ADP","organizationId":"af854a3a-2127-422b-91ae-364da2661108","modified":"2026-10-21T00:17:16.110Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-30T12:48:49.541Z"}],"references":[{"url":"https://github.com/perl5-dbi/dbi/security/advisories/GHSA-7393-6f8r-fhh3","tags":["vendor-advisory"],"source":"CPANSec"},{"url":"https://github.com/perl5-dbi/dbi/commit/c2ff4df575d7af625bb4d0d1ef7539f90b22d8b2.patch","tags":["patch"],"source":"CPANSec"},{"url":"https://metacpan.org/release/HMBRAND/DBI-1.656/changes","tags":["release-notes"],"source":"CPANSec"},{"url":"http://www.openwall.com/lists/oss-security/2026/10/20/37","tags":[],"source":"CVE"},{"url":"https://github.com/perl5-dbi/dbi/security/advisories/GHSA-7393-6f8r-fhh3","tags":["exploit"],"source":"CISA-ADP"}],"weaknesses":[{"id":"CWE-843","description":"CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')","source":"CPANSec"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-30T12:47:30.050651Z","decisions":[{"name":"Exploitation","value":"poc"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"DBI versions before 1.656 for Perl crash via type confusion in dbi_profile when a database handle is destroyed under a Profile Path with an {attr} element","titleSource":"CPANSec","descriptionSource":"CPANSec","description":"DBI versions before 1.656 for Perl crash via type confusion in dbi_profile when a database handle is destroyed under a Profile Path with an {attr} element.\n\nAn {attr} element names a database handle attribute, which dbi_profile reads from the handle's inner hash. It expects the inner handle as a reference and dereferences it, but a handle that is being destroyed hands back the inner hash itself, so the dereference yields the hash's bucket array. A type check on that pointer usually fails and the call goes unprofiled. When the memory it addresses passes the check, the attribute lookup dereferences a NULL or invalid pointer and the process dies on SIGSEGV.\n\nThe Path is set by the application, by the Profile handle attribute, or by the DBI_PROFILE environment variable, so `DBI_PROFILE={ImplementorClass}` can crash an unmodified program.","score":2.9,"severity":"low","published":"2026-10-20T21:23:13.373Z","modified":"2026-10-30T12:48:49.541Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"","name":"DBI","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"1.656","versionType":"custom"}],"defaultStatus":"unaffected","packageURL":"pkg:cpan/DBI","cpes":[],"source":"CPANSec","url":"https://www.cve.org/CVERecord?id=CVE-2026-108518"}],"remediation":[{"text":"Upgrade to DBI 1.656 or later.","source":"CPANSec","url":"https://www.cve.org/CVERecord?id=CVE-2026-108518"}],"references":["https://github.com/perl5-dbi/dbi/security/advisories/GHSA-7393-6f8r-fhh3","https://github.com/perl5-dbi/dbi/commit/c2ff4df575d7af625bb4d0d1ef7539f90b22d8b2.patch","https://metacpan.org/release/HMBRAND/DBI-1.656/changes","http://www.openwall.com/lists/oss-security/2026/10/20/37"],"sources":[{"name":"CVE","id":"CVE-2026-108518","modified":"2026-10-30T12:48:49.541Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-108518"}],"assessments":[{"source":"CISA-ADP","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","score":2.9}],"sourceAffected":[],"observedAt":"2026-10-30T13:08:36.601Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T14:05:32.453Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-30T13:15:34.705Z","attemptedAt":"2026-10-30T13:15:34.705Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-10-30T13:15:34.715Z","attemptedAt":"2026-10-30T13:15:34.715Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-30T13:15:35.597Z","attemptedAt":"2026-10-30T13:15:35.597Z"},{"source":"EPSS","status":"available","checkedAt":"2026-10-30T13:15:34.717Z","attemptedAt":"2026-10-30T13:15:34.717Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-108518","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108518","modified":"2026-10-22T17:21:57.293","checkedAt":"2026-10-30T13:15:34.705Z"},{"source":"FIRST EPSS","id":"CVE-2026-108518","url":"https://www.first.org/epss/","probability":0.00275,"percentile":0.19952,"date":"2026-10-29","checkedAt":"2026-10-30T13:15:34.717Z"},{"source":"ENISA EUVD","id":"EUVD-2026-106230","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-106230","modified":"Oct 30, 2026, 12:48:49 PM","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","checkedAt":"2026-10-30T13:15:35.597Z"}],"aiSummary":{"text":"DBI versions before 1.656 for Perl may crash due to type confusion in dbi_profile when a database handle is destroyed under a Profile Path with an {attr} element. The crash occurs when the attribute lookup dereferences a NULL or invalid pointer. Local access is required to set the Profile Path.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T13:11:07.688Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-108518"}]}}