CVE-2026-60081

Description

DBI::ProfileData versions before 1.651 for Perl do not limit the path index. The path index column of profile dump files is used to allocate an array of data for the parser. An unbounded value allows an attacker to specify a large index and consume available memory.

PUBLISHED Reserved 2026-07-08 | Published 2026-07-14 | Updated 2026-07-14 | Assigner CPANSec

Problem types

CWE-770 Allocation of Resources Without Limits or Throttling

Product status

References

www.openwall.com/lists/oss-security/2026/07/14/14

github.com/...bi/dbi/security/advisories/GHSA-ww49-w4mv-jrr4 vendor-advisory

metacpan.org/release/HMBRAND/DBI-1.651/changes release-notes

github.com/...6764e755e83ee1ebb1b40760e5b53eb50960bd7a.patch patch

cve.org (CVE-2026-60081)

nvd.nist.gov (CVE-2026-60081)

Download JSON