# CVE-2026-108518: Perl DBI type confusion in dbi_profile leading to crash

Source: https://junglewise.ai/threats/cve-2026-108518-dbi-versions-before-1-656-for-perl-crash-via-type-confusion-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-20. Updated: 2026-10-20  
License: CC BY 4.0 with a link back

CVE-2026-108518 · Severity: info · Published 2026-10-20

Perl's DBI module (a database abstraction layer used by many applications) crashes when profiling database connections if a Profile Path contains an {attr} element. An attacker can trigger this crash remotely by setting the DBI_PROFILE environment variable on a system running an unmodified Perl application that uses DBI, causing a denial of service.

Technologies: [Perl DBI](https://junglewise.ai/threats/technologies/perl-dbi). Vendors: [Perl](https://junglewise.ai/threats/vendors/perl).

## Quick answers

**Is CVE-2026-108518 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-108518 being exploited in the wild.

**How severe is CVE-2026-108518?** Informational severity, published 20 October 2026.

**Which products and versions are affected?** Perl DBI before 1.656.

**Is there a fix for CVE-2026-108518?** Yes: fixed in DBI 1.656. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-108518 attacked?** It is attacked over the network or with local access, in a software library.

**Am I affected by CVE-2026-108518?** Check whether you run Perl DBI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in DBI 1.656

## Technical details

During database handle destruction, dbi_profile attempts to access handle attributes via the {attr} element in the Profile Path. The vulnerability is a type confusion: when a handle is being destroyed, dbi_profile receives a raw inner hash instead of a reference, but the code unconditionally dereferences it as if it were a reference, reading the hash's bucket array instead. This causes a NULL or invalid pointer dereference on SIGSEGV. The DBI_PROFILE environment variable or Profile handle attribute can be set by the application or attacker to trigger the crash.

## Affected products

- Perl DBI before 1.656

## Timeline

- 2026-10-20: disclosed
- 2026-10-09: patched

## References

- [https://cpan.org/modules](https://cpan.org/modules)
- [https://github.com/perl5-dbi/dbi/commit/c2ff4df575d7af625bb4d0d1ef7539f90b22d8b2.patch](https://github.com/perl5-dbi/dbi/commit/c2ff4df575d7af625bb4d0d1ef7539f90b22d8b2.patch)

## Related threats

- [Perl DBI DBD::DBM lock release on failed open](https://junglewise.ai/threats/cve-2026-111879-dbi-versions-before-1-656-for-perl-hang-on-a-later-open-of-a-dbd)
- [Perl DBI FetchHashKeyName integer value handling integer overflow](https://junglewise.ai/threats/cve-2026-88816-dbi-versions-before-1-654-for-perl-incorrectly-treat-numeric)