CVE-2026-60081
HIGHDBI::ProfileData versions before 1.651 for Perl do not limit the path index
Title source: cnaDescription
DBI::ProfileData versions before 1.651 for Perl do not limit the path index. The path index column of profile dump files is used to allocate an array of data for the parser. An unbounded value allows an attacker to specify a large index and consume available memory.
References (4)
Core 4
Core References
Vendor Advisory vendor-advisory
https://github.com/perl5-dbi/dbi/security/advisories/GHSA-ww49-w4mv-jrr4
Release Notes release-notes
https://metacpan.org/release/HMBRAND/DBI-1.651/changes
Scores
CVSS v3
7.5
EPSS
0.0038
EPSS Percentile
30.7%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-770
Status
published
Products (1)
HMBRAND/DBI::ProfileData
< 1.651
Published
Jul 14, 2026
Tracked Since
Jul 14, 2026