CVE-2026-60081

High

Description

DBI::ProfileData versions before 1.651 for Perl do not limit the path index. The path index column of profile dump files is used to allocate an array of data for the parser. An unbounded value allows an attacker to specify a large index and consume available memory.

SeverityHigh

CVSS7.5

Exploit probability—

ProductDBI::ProfileData

PublishedJul 14, 2026

First seenJul 14, 2026

Weakness typeCWE-770Allocation of resources without limits

How to fix

Update

HMBRAND DBI::ProfileData1.651 or later

Patches

github.com/perl5-dbi/dbi/commit/6764e755e83ee1ebb1b40760e5b53eb50960bd7a.patch

Vendor advisories

github.com/perl5-dbi/dbi/security/advisories/GHSA-ww49-w4mv-jrr4
metacpan.org/release/HMBRAND/DBI-1.651/changes

Affected products

Product	Affected versions	Fixed in
HMBRAND DBI::ProfileData	v < 1.651	1.651

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.