Perl-DBI:1.641 Security Update — AlmaLinux 8 (ALSA-2026:38901)

ALSA-2026:38901 updates perl-DBI on AlmaLinux 8, fixing CVE-2026-9698 — an out-of-bounds write (CWE-787) rated CVSS 9.8 Critical — in the standard Perl database interface module. Any Perl application using DBI to talk to databases should update immediately: dnf update perl-DBI.

Critical 9.8 CVSS 2026-10-26

AlmaLinux 8

Betroffene Versionen

1.641

Was das unter einer SharedLicense-Lizenz bedeutet

An out-of-bounds write in the database interface layer means crafted data flowing through a Perl application's database calls can corrupt memory and potentially execute code — DBI sits under countless legacy Perl scripts on hosting servers.

Type:

security

Severity:

important

Release date:

2026-10-26

Description:

The perl-DBI package provides the standard database interface module for the Perl programming language. It implements a database-independent interface, meaning it defines a consistent set of methods, variables, and conventions for database operations.

Security Fix(es):

* DBI: DBI: Buffer overflow in error handling can lead to arbitrary code execution (CVE-2026-9698)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References:

Updated packages listed below:

Architecture	Package	Checksum
aarch64	perl-DBI-1.641-5.module_el8.10.0+4218+c616d9bd.aarch64.rpm	ef57302860175b108dff5c95af51d267b7a72573d5532883dd2bc3060f95c8cc
ppc64le	perl-DBI-1.641-5.module_el8.10.0+4218+c616d9bd.ppc64le.rpm	de9aef2ea7e2a40614b05d1c6ffc86010c224e4f4420f84d45d20eb548778801
s390x	perl-DBI-1.641-5.module_el8.10.0+4220+8669cc49.s390x.rpm	d1ff1cfe807a5232bc5efe774fa0e9c352da66e3a85ed4510f5a7fa315e71b6b
x86_64	perl-DBI-1.641-5.module_el8.10.0+4219+13f48a6e.x86_64.rpm	7cf3795e37fa1fe34ba3da538457164c7f0a54fc3af5a6beb017bebb4b65e116

Notes:

This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.

Häufig gestellte Fragen

What is CVE-2026-9698?

It is an out-of-bounds write vulnerability (CWE-787) in perl-DBI, the standard database interface module for Perl, rated Critical at CVSS 9.8. AlmaLinux fixes it in the perl-DBI:1.641 module update (ALSA-2026:38901, rated Important).

Who is affected?

Any AlmaLinux 8 system with perl-DBI installed and Perl applications performing database operations — legacy billing panels, cron scripts and in-house tools commonly use it.

How do I apply the fix?

Run dnf update perl-DBI (within the 1.641 module stream) — Perl scripts pick up the patched module on their next execution, no service restart needed beyond long-running daemons.

How would this flaw be exploited?

Out-of-bounds writes in DBI are reached through data passed to database calls — an attacker who controls input that reaches the driver layer (query parameters, fetched content) can aim for memory corruption. Patching removes the class entirely.

Referenzen

Sicherheitshinweise

System auf Schwachstellen prüfen

Wählen Sie Ihr Produkt und Betriebssystem, um die passenden Fix-Befehle zu sehen.

System prüfen

Häufig gestellte Fragen

Verwandte Warnhinweise

System auf Schwachstellen prüfen