CVE-2026-111879Medium· 5.5▾ SunlitA flaw was found in perl-DBI. When creating or opening a database table in the DBD::DBM module fails due to an error, an exclusive file lock acquired during initialization is not properly released. A user or attacker who can control connec…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 30.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 22.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
Last analysed / modified upstream
— → 5.5
none → medium
0.2%
0.2% → 0.3%
A flaw was found in perl-DBI. When creating or opening a database table in the DBD::DBM module fails due to an error, an exclusive file lock acquired during initialization is not properly released. A user or attacker who can control connection parameters can trigger this failure, leaving the lock active indefinitely. This issue leads to a Denial of Service (DoS), as subsequent attempts by any process to access the affected table will hang permanently.
perl-DBI: perl-DBI: Denial of Service via unreleased table lock on error — rated Moderate by Red Hat. Released 2026-10-20, updated 2026-10-21.
Affected:
No fix planned:
Out of support scope
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-108518Medium· 4.7perl-dbi: perl-dbi: Denial of Service via type confusion in dbi_profile (CVE-2026-108518)
CVE-2026-116152Medium· 5.3ImageMagick: ImageMagick: Denial of Service via memory leak in MAT decoder (CVE-2026-116152)
CVE-2026-106072Medium· 6.7nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)
CVE-2026-105483High· 7.4nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)
CVE-2026-106073Low· 3.3nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073)
CVE-2026-106069High· 7.4nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)