Read the docs
TI-2026-78162 Aliases CVE-2026-111879

Improper locking in DBI for Perl blocks later DBD::DBM table opens

Priority LOW 35CWE-667Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
Partial Red Hat: 5 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat.

Summary

DBI versions before 1.656 for Perl fail to release a lock when opening a DBD::DBM table fails. An open_data call takes an exclusive file lock, then croaks on a bad dbm_mldbm value, a failing tie or a missing data file, and never releases the lock (CWE-667). A caller who sets those values through the DSN or connect attributes can trigger it, and any later open of that table, even from another database handle, then blocks for as long as the stale lock is held.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Description from the CNA

DBI versions before 1.656 for Perl hang on a later open of a DBD::DBM table because a failed open_data does not release the table's lock. open_data creates the table's lock file and takes an exclusive flock on it for a CREATE, before the checks that can croak: a dbm_mldbm value that is not a module name, a failing tie, or a missing data file. The croak unwinds before the table object is blessed, so nothing releases the lock, and the meta data holding the open descriptor stays cached on the database handle. The dbm_mldbm and dbm_type values come from the DSN or the connect attributes, so a caller that chooses the serializer or the storage backend can trigger the failure. The flock has no timeout, so a later open of that table (even through a separate database handle) blocks for as long as the handle holding the stale lock lives, in the same process or any other.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00327 25th percentileScored 2026-11-07
Fix Partial DBI: 1.656Red Hat: 5 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—DBIbefore 1.6561.656Patch availableCNA
  • DBI Vendor— Affected before 1.656 Fixed in 1.656 Patch available CNA

Remediation

Upgrade DBI to version 1.656 or later. The sources list no fixed version for Red Hat Enterprise Linux 6 (no fix planned) and Red Hat Enterprise Linux 7, 8, 9 and 10 (none available).

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

  • Fix · CNA DBI Fixed in 1.656

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 10AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 8AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 9AffectedNo fix yet: Fix deferred

Timeline

  1. 2026-10-21 Threatist record created from CVE-2026-111879
  2. 2026-10-21 Affected versions changed · Red Hat
  3. 2026-10-21 CVSS score added · Red Hat
  4. 2026-10-30 CVSS score added · CISA ADP
  5. 2026-10-30 CISA SSVC decision points changed

References

Sources