# CVE-2026-60081: Perl DBI memory exhaustion in DBI::ProfileData parser

Source: https://junglewise.ai/threats/cve-2026-60081-perl-dbi-memory-exhaustion-in-dbi-profiledata-parser  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-14. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2026-60081 · Severity: info · CVSS 3.3 · Published 2026-07-14

The DBI::ProfileData component in the Perl DBI library, which is used for analyzing database performance profiles, contains a flaw in how it processes profile dump files. An attacker can provide a specially crafted, small profile file that causes the parser to consume excessive amounts of system memory. This can lead to a denial-of-service condition where the application or server crashes or becomes unresponsive.

Technologies: [Perl DBI Team DBI](https://junglewise.ai/threats/technologies/dbi). Vendors: [Perl DBI Team](https://junglewise.ai/threats/vendors/perl-dbi-team).

## Quick answers

**Is CVE-2026-60081 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-60081 being exploited in the wild.

**How severe is CVE-2026-60081?** Informational severity, with a CVSS score of 3.3, published 14 July 2026.

**Which products and versions are affected?** Perl DBI Team DBI before 1.651.

**Is there a fix for CVE-2026-60081?** A patch was published on 2026-07-14: Version 1.651 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-60081 attacked?** It is attacked with local access or over the network, in a software library.

**Am I affected by CVE-2026-60081?** Check whether you run Perl DBI Team DBI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A resource exhaustion vulnerability (CWE-770) exists in DBI::ProfileData's profile parser. The parser reads 'path index' values from profile dump files and uses them to set the size of an internal array (@path) without upper-bound validation. By providing a large index value (e.g., +10000000), an attacker can trigger a memory amplification effect where a small input file causes the allocation of a massive sparse array, leading to a denial-of-service (DoS) via memory exhaustion. This affects any workflow where the parser processes untrusted profile data, such as in CI/CD pipelines or observability tools. The issue is fixed in version 1.651 by introducing a $MAX_PATH_DEPTH limit.

## Affected products

- Perl DBI Team DBI before 1.651

## Timeline

- 2026-07-10: other: Fix developed by maintainers
- 2026-07-14: patched: Version 1.651 released
- 2026-07-14: advisory: GHSA-ww49-w4mv-jrr4 published

## References

- [https://cpan.org/modules](https://cpan.org/modules)
- [https://github.com/perl5-dbi/dbi/commit/6764e755e83ee1ebb1b40760e5b53eb50960bd7a.patch](https://github.com/perl5-dbi/dbi/commit/6764e755e83ee1ebb1b40760e5b53eb50960bd7a.patch)
- [https://github.com/perl5-dbi/dbi/security/advisories/GHSA-ww49-w4mv-jrr4](https://github.com/perl5-dbi/dbi/security/advisories/GHSA-ww49-w4mv-jrr4)
- [https://metacpan.org/release/HMBRAND/DBI-1.651/changes](https://metacpan.org/release/HMBRAND/DBI-1.651/changes)

## Related threats

- [Perl DBI code injection in Profile attribute](https://junglewise.ai/threats/cve-2026-14380-perl-dbi-code-injection-in-profile-attribute)
- [Perl DBI stack buffer overflow in error handling](https://junglewise.ai/threats/cve-2026-9698-perl-dbi-stack-buffer-overflow-in-error-handling)
- [Perl DBI heap overflow in preparse SQL statement expansion](https://junglewise.ai/threats/cve-2026-10879-perl-dbi-heap-overflow-in-preparse-sql-statement-expansion)