ALSA-2026:99162: Important: perl-DBI security update
The perl-DBI package provides the standard database interface module for the Perl programming language. It implements a database-independent interface, meaning it defines a consistent set of methods, variables, and conventions for database operations.
Security Fix(es):
perl-DBI: DBI: Loading of arbitrary modules via unvalidated dbmtype and dbmmldbm attributes in DBD::DBM (CVE-2026-78030)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
almalinux/perl-DBIto a version that resolves this vulnerability.Fixed in 1.641-5.el8_10
Event History
Frequently Asked Questions
What attacker-controlled input is relevant to exploitation?
Exploitation involves unvalidated dbm_type and dbm_mldbm attributes in the DBD::DBM component. An attacker would need a way to influence those attributes so that DBI loads an arbitrary module.
Which component should be reviewed for exposure?
Review Perl applications that use the DBD::DBM driver and accept or construct dbm_type or dbm_mldbm attributes from untrusted input. The provided information does not establish whether other DBI drivers are affected.
How can I determine whether an installed system may be affected?
Check whether the system has the almalinux/perl-dbi package installed and whether deployed applications use DBD::DBM with dbm_type or dbm_mldbm attributes. Compare the installed package against the security update identified by ALSA-2026:99162.