Hi,

The following vulnerabilities were published for libdbi-perl.

CVE-2026-108518[0]:
| DBI versions before 1.656 for Perl crash via type confusion in
| dbi_profile when a database handle is destroyed under a Profile Path
| with an {attr} element.  An {attr} element names a database handle
| attribute, which dbi_profile reads from the handle's inner hash. It
| expects the inner handle as a reference and dereferences it, but a
| handle that is being destroyed hands back the inner hash itself, so
| the dereference yields the hash's bucket array. A type check on that
| pointer usually fails and the call goes unprofiled. When the memory
| it addresses passes the check, the attribute lookup dereferences a
| NULL or invalid pointer and the process dies on SIGSEGV.  The Path
| is set by the application, by the Profile handle attribute, or by
| the DBI_PROFILE environment variable, so
| `DBI_PROFILE={ImplementorClass}` can crash an unmodified program.


CVE-2026-111879[1]:
| DBI versions before 1.656 for Perl hang on a later open of a
| DBD::DBM table because a failed open_data does not release the
| table's lock.  open_data creates the table's lock file and takes an
| exclusive flock on it for a CREATE, before the checks that can
| croak: a dbm_mldbm value that is not a module name, a failing tie,
| or a missing data file. The croak unwinds before the table object is
| blessed, so nothing releases the lock, and the meta data holding the
| open descriptor stays cached on the database handle.  The dbm_mldbm
| and dbm_type values come from the DSN or the connect attributes, so
| a caller that chooses the serializer or the storage backend can
| trigger the failure.  The flock has no timeout, so a later open of
| that table (even through a separate database handle) blocks for as
| long as the handle holding the stale lock lives, in the same process
| or any other.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-108518
https://www.cve.org/CVERecord?id=CVE-2026-108518
https://lists.security.metacpan.org/cve-announce/msg/44513047/
[1] https://security-tracker.debian.org/tracker/CVE-2026-111879
https://www.cve.org/CVERecord?id=CVE-2026-111879
https://lists.security.metacpan.org/cve-announce/msg/44513053/

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
libdbi-perl, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1151666@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
gregor herrmann <gregoa@debian.org> (supplier of updated libdbi-perl package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Fri, 23 Oct 2026 01:54:00 +0200
Source: libdbi-perl
Architecture: source
Version: 1.656-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Perl Group <pkg-perl-maintainers@lists.alioth.debian.org>
Changed-By: gregor herrmann <gregoa@debian.org>
Closes: 1151666
Changes:
 libdbi-perl (1.656-1) unstable; urgency=medium
 .
   * Import upstream version 1.656.
     + Prevent dbi_profile crash (CVE-2026-108518) (Henrik Teichmann)
     + Fix lock file not removed when DBD::DBM check for bad serializer class
       fails. (CVE-2026-111879)
     Closes: #1151666
Checksums-Sha1:
 8b79f4f49bb17936e5dbbd455ae5e072eae75c5f 2458 libdbi-perl_1.656-1.dsc
 88a03b3af003fb4f7644262d76c223a78a76c4ea 742805 libdbi-perl_1.656.orig.tar.gz
 5fd47908139e75a253fd369487fbbf0b7a1666aa 13912 libdbi-perl_1.656-1.debian.tar.xz
 c8a998a4e1492f279bf45928901f334edac8251d 1277688 libdbi-perl_1.656-1.git.tar.xz
 dd30e1e1e06bc334565bfb2bc94041558e141af6 17748 libdbi-perl_1.656-1_source.buildinfo
Checksums-Sha256:
 190f0df74912faad0b4c91e2777cdd2f55e7af63e678d0820ec5cdef2dd5f9c4 2458 libdbi-perl_1.656-1.dsc
 ab5f2b9aef00951ed4598723d6131a00b03e68193478dd5e5f211015520a6ef0 742805 libdbi-perl_1.656.orig.tar.gz
 3585d870e34f3992c51aaa928604b5fd5b27a8dfe7688229a6411512b1d469d9 13912 libdbi-perl_1.656-1.debian.tar.xz
 0254c2feed44bbbf4d6582959ae42c1c8f9f77b2d4694068d8c5df09ffc7e691 1277688 libdbi-perl_1.656-1.git.tar.xz
 48eb05f0f3cc6c2e666645afc6ffbe8eacf2f6dde89fcaf98acb19f8892eec49 17748 libdbi-perl_1.656-1_source.buildinfo
Files:
 47837d9899cd2a89d2d7da58500f1375 2458 perl optional libdbi-perl_1.656-1.dsc
 716c1e6ddcb88651fbcaeaedc938797b 742805 perl optional libdbi-perl_1.656.orig.tar.gz
 69d21080d436435d6fd9fe861ea6b449 13912 perl optional libdbi-perl_1.656-1.debian.tar.xz
 8680e62bffa89a52e7518c7f7e4ea2f1 1277688 perl None libdbi-perl_1.656-1.git.tar.xz
 d8b5afc5fbd14f3e2899614cd5dde409 17748 perl optional libdbi-perl_1.656-1_source.buildinfo
Git-Tag-Info: tag=eb133fa5a82d6e8153070f7591bf64dcc26eb32a fp=d1e1316e93a760a8104d85fabb3a68018649aa06
Git-Tag-Tagger: gregor herrmann <gregoa@debian.org>
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmrao84ACgkQYG0ITkaD
wHm/vA/+Jqd1gowODveAOZ8wAeq0EzO+HT/UjQMk0akFYvAsD2BHZP8Dwa2QBpLi
ra6l4n3b7nvevbg8w6DMAfGSnue7YXxfLrQiH0XkHSmIKnJQsuf0YhKVYcAJ2h0x
Fizfb60YvhWPV5/aDVh53Mbtu4xEGjTZd+q8Kfu/OMHo6nf+EuStLcpYdelPxl2l
/QOehBPVZFUb6rUgcK/ZFAqtNQDDkMnKAkt1G6fF+Q6+JkVpWihZlm21fU45LIvX
PVVuOfpDKUeAwvzrl3H1kD3iaqKh6hvg/97HWlk6+1YvsodY1Z8THrIQSinkzRlr
YjL1KLuCDiwdmUtILblssRTY7Tqtg94oypbQyR8zIVMKyZm1web7fH52EiMl+0zG
FnUzYL3wq3jrnv4Ki3mnchRCYFR9wY+Y0kFUzX8r9gNISWLsSwCSHT2davokhpIo
WnltnjAmHz9KLA3sh4EyiiZqFZo4VQatYER8hphWY0shszqDaMQiRitIDZVD6H8V
g+dsgWlHxOg6GKiA/QeEqXxIb0cFa/2MkU8Eaw8Lh2zM0VOCB6O6eYbVl0CYK8Ov
8DdJxY+Ply94SPrZzD9MV5oE+NBK6KvQFq9myhfBz9rlNqTJd+P00cOE4PNHfOe1
e0GQ06aMwrEFbZwJoPPuwwZ2p0vlKsBS3tHXEg1lWHoyOY5jqFo=
=LC2j
-----END PGP SIGNATURE-----