Back to Security Advisories

Perl-DBI:1.641 Security Update — AlmaLinux 8 (ALSA-2026:38901)

ALSA-2026:38901 updates perl-DBI on AlmaLinux 8, fixing CVE-2026-9698 — an out-of-bounds write (CWE-787) rated CVSS 9.8 Critical — in the standard Perl database interface module. Any Perl application using DBI to talk to databases should update immediately: dnf update perl-DBI.

Critical 9.8 CVSS
AlmaLinux 8

Affected Versions

1.641

What this means under a SharedLicense license

An out-of-bounds write in the database interface layer means crafted data flowing through a Perl application's database calls can corrupt memory and potentially execute code — DBI sits under countless legacy Perl scripts on hosting servers.

Type:

security

Severity:

important

Release date:

2026-10-26

Description:

The perl-DBI package provides the standard database interface module for the Perl programming language. It implements a database-independent interface, meaning it defines a consistent set of methods, variables, and conventions for database operations.

Security Fix(es):

* DBI: DBI: Buffer overflow in error handling can lead to arbitrary code execution (CVE-2026-9698)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References:

Updated packages listed below:

Architecture Package Checksum
aarch64 perl-DBI-1.641-5.module_el8.10.0+4218+c616d9bd.aarch64.rpm ef57302860175b108dff5c95af51d267b7a72573d5532883dd2bc3060f95c8cc
ppc64le perl-DBI-1.641-5.module_el8.10.0+4218+c616d9bd.ppc64le.rpm de9aef2ea7e2a40614b05d1c6ffc86010c224e4f4420f84d45d20eb548778801
s390x perl-DBI-1.641-5.module_el8.10.0+4220+8669cc49.s390x.rpm d1ff1cfe807a5232bc5efe774fa0e9c352da66e3a85ed4510f5a7fa315e71b6b
x86_64 perl-DBI-1.641-5.module_el8.10.0+4219+13f48a6e.x86_64.rpm 7cf3795e37fa1fe34ba3da538457164c7f0a54fc3af5a6beb017bebb4b65e116

Notes:

This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.

Frequently Asked Questions

What is CVE-2026-9698?
It is an out-of-bounds write vulnerability (CWE-787) in perl-DBI, the standard database interface module for Perl, rated Critical at CVSS 9.8. AlmaLinux fixes it in the perl-DBI:1.641 module update (ALSA-2026:38901, rated Important).
Who is affected?
Any AlmaLinux 8 system with perl-DBI installed and Perl applications performing database operations — legacy billing panels, cron scripts and in-house tools commonly use it.
How do I apply the fix?
Run dnf update perl-DBI (within the 1.641 module stream) — Perl scripts pick up the patched module on their next execution, no service restart needed beyond long-running daemons.
How would this flaw be exploited?
Out-of-bounds writes in DBI are reached through data passed to database calls — an attacker who controls input that reaches the driver layer (query parameters, fetched content) can aim for memory corruption. Patching removes the class entirely.

References

Security Advisories

Related Advisories

Qt5-Qtdeclarative Security Update — AlmaLinux 8 (ALSA-2026:96075)

2026-11-10

Webkit2gtk3 Security Update — AlmaLinux 8 (ALSA-2026:96080)

2026-11-09

Util-Linux Security Update — AlmaLinux 8 (ALSA-2026:96212)

2026-11-09

Check your system for vulnerabilities

Select your product and operating system to see the exact fix commands that apply to you.

Check Your System