Code Injection Vulnerability in Perl DBI

A code injection vulnerability (CWE-94) has been identified in the perl-DBI package shipped with Red Hat Enterprise Linux (RHEL) versions 9 and 10. This security flaw stems from an incomplete remediation of the previously disclosed CVE-2026-14380. The vulnerability allows an authenticated attacker to perform code injection, which may result in remote code execution, unauthorized data access, or denial of service, depending on the specific application implementation leveraging the database interface. Red Hat has categorized this as a high-severity issue, specifically affecting RHEL 9.8.z and 10.2.z environments. Defenders should prioritize patching the perl-DBI package as updates become available via official channels.

Impact

Successful exploitation of this flaw could allow an authenticated attacker to compromise the integrity, confidentiality, and availability of database-backed applications. Given the widespread use of Perl DBI for database connectivity, the potential scope of impact includes any service or administrative tool utilizing this library to execute database queries. As this is a flaw in a core language interface, the damage could involve full system compromise if the Perl scripts are running with elevated privileges.

Recommendation

• Apply the security patches for perl-DBI issued by Red Hat for RHEL 9.8.z and 10.2.z immediately upon availability.
• Audit applications that utilize perl-DBI to identify where user-supplied input is passed to database interaction methods, as these are the likely entry points for exploitation.
• Monitor for unexpected child processes spawned by services or scripts that rely on the Perl DBI interface.
• Review Red Hat Bugzilla entry 2513963 for updates regarding specific remediation steps and version-specific patch releases.