Improper locking in DBI for Perl blocks later DBD::DBM table opens
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Partial Red Hat: 5 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat.
Summary
DBI versions before 1.656 for Perl fail to release a lock when opening a DBD::DBM table fails. An open_data call takes an exclusive file lock, then croaks on a bad dbm_mldbm value, a failing tie or a missing data file, and never releases the lock (CWE-667). A caller who sets those values through the DSN or connect attributes can trigger it, and any later open of that table, even from another database handle, then blocks for as long as the stale lock is held.
Written with Claude Haiku 5.5 from the sources below · 2026-10-30
Description from the CNA
DBI versions before 1.656 for Perl hang on a later open of a DBD::DBM table because a failed open_data does not release the table's lock. open_data creates the table's lock file and takes an exclusive flock on it for a CREATE, before the checks that can croak: a dbm_mldbm value that is not a module name, a failing tie, or a missing data file. The croak unwinds before the table object is blessed, so nothing releases the lock, and the meta data holding the open descriptor stays cached on the database handle. The dbm_mldbm and dbm_type values come from the DSN or the connect attributes, so a caller that chooses the serializer or the storage backend can trigger the failure. The flock has no timeout, so a later open of that table (even through a separate database handle) blocks for as long as the handle holding the stale lock lives, in the same process or any other.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | DBI | before 1.656 | 1.656 | Patch available | CNA |
- DBI Vendor— Affected before 1.656 Fixed in 1.656 Patch available CNA
Remediation
Upgrade DBI to version 1.656 or later. The sources list no fixed version for Red Hat Enterprise Linux 6 (no fix planned) and Red Hat Enterprise Linux 7, 8, 9 and 10 (none available).
Written with Claude Haiku 5.5 from the sources below · 2026-10-30
- Fix · CNA DBI Fixed in 1.656
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 10 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
Timeline
- 2026-10-21 Threatist record created from CVE-2026-111879
- 2026-10-21 Affected versions changed · Red Hat
- 2026-10-21 CVSS score added · Red Hat
- 2026-10-30 CVSS score added · CISA ADP
- 2026-10-30 CISA SSVC decision points changed
References
Sources
- CVE-2026-111879 · CVE Program
- CVE-2026-111879 · NVD
- FIRST EPSS
- CVE-2026-111879 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences