Cyber ·
CVE-2026-108518: DBI for Perl before 1.656 can crash due to a type confusion
The CPAN Security Group advisory describes a type confusion in dbi_profile in the DBI module for Perl, in versions before 1.656. The flaw can crash the process when a database handle is destroyed under a Profile Path with an {attr} element.
Advisory CVE-2026-108518 was published on 20 October 2026 in the oss-sec list feed, attributed to Robert Rothenberg and registered by the CPAN Security Group. The affected distribution is DBI, in versions before 1.656. The problem is a type confusion in dbi_profile that can cause a failure when a database handle is destroyed under a Profile Path with an {attr} element. The stated impact is a crash, meaning the affected process stops. The text received is an automatic translation and is truncated, so the full reading should be done in the original advisory, on the oss-sec list, in the MetaCPAN module record and in the DBI project's VCS repository, all referenced in the source. Relevance: Rota Nacional does not maintain DBI, does not patch it and does not claim to solve this flaw. Teams running Perl services that integrate with the API should identify the installed DBI version and plan the upgrade, then verify the result in their own environment.