CVE-2026-60081: DBI::ProfileData for Perl DoS Vulnerability

CVE-2026-60081 Overview

CVE-2026-60081 is a resource allocation vulnerability in the Perl DBI::ProfileData module in versions before 1.651. The module fails to bound the path index column when parsing profile dump files. An attacker who controls a dbi.prof file can specify an arbitrarily large index value that forces the parser to allocate an oversized array, exhausting available memory on the host process.

The flaw is classified under [CWE-770: Allocation of Resources Without Limits or Throttling]. It affects any Perl application that consumes untrusted profile data through the DBI::ProfileData parser.

Critical Impact
A malicious profile dump file can trigger unbounded memory allocation, leading to denial of service in Perl applications that parse DBI profile output.

Affected Products

Perl DBI module — DBI::ProfileData component
All versions prior to 1.651
Applications and tooling that ingest dbi.prof files from untrusted sources

Discovery Timeline

2026-07-14 - CVE-2026-60081 published to NVD
2026-07-14 - GitHub Security Advisory GHSA-ww49-w4mv-jrr4 published by the perl5-dbi project
2026-07-14 - Discussion posted to the OpenWall oss-security mailing list
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-60081

Vulnerability Analysis

The DBI::ProfileData Perl module parses profile dump files produced by the DBI profiling subsystem. Each record includes a path index column that identifies its position in the profile path structure. The parser reads this integer directly from the input and uses it to size an internal array that stores the associated profile data.

Because the parser applies no upper bound to the index value, an attacker who supplies a crafted profile file can request allocation of an array sized to any 64-bit integer. Perl attempts to satisfy the allocation, consuming all available process memory and terminating the interpreter or triggering an out-of-memory condition on the host.

The vulnerability requires no authentication and no user interaction beyond feeding the malicious file to a parser instance. Impact is limited to availability — the flaw does not corrupt memory or grant execution.

Root Cause

The root cause is missing input validation on the path index field within lib/DBI/ProfileData.pm. The parser trusts attacker-controlled length metadata and allocates before validating.

Attack Vector

Exploitation requires an application to parse a profile dump file supplied or influenced by an attacker. Common scenarios include automated log ingestion pipelines, shared debugging tooling, and CI systems that process dbi.prof artifacts from untrusted repositories or build outputs.

text

// Patch excerpt from lib/DBI/ProfileData.pm (CVE-2026-60081 fix)
 This module can also be used to roll your own profile analysis:

+  local $DBI::ProfileData::MAX_PATH_DEPTH = 256; # override the maximum path depth of files
+
   # load data from dbi.prof
   $prof = DBI::ProfileData->new(File => "dbi.prof");

Source: GitHub Patch Commit 6764e755. The fix introduces a MAX_PATH_DEPTH cap that bounds the parser's array allocation.

Detection Methods for CVE-2026-60081

Indicators of Compromise

Perl processes terminating with out-of-memory errors while invoking DBI::ProfileData->new
dbi.prof files containing implausibly large path index values in the first column of profile records
Unexpected memory spikes on hosts that process user-supplied profile data

Detection Strategies

Inventory Perl installations and enumerate the installed DBI version using perl -MDBI -e 'print $DBI::VERSION'; flag any host below 1.651
Add file-content inspection to ingestion pipelines that reject profile records whose path index exceeds a sane depth (for example, 256)
Instrument parser wrappers to log the maximum observed path index and alert on outliers

Monitoring Recommendations

Monitor resident set size (RSS) of Perl worker processes that call the profile parser and alert on sudden growth toward system limits
Correlate OOM-killer events in dmesg or systemd journals with recent dbi.prof file arrivals
Track CPAN dependency manifests in build systems to detect stale DBI versions reintroduced by lockfiles

How to Mitigate CVE-2026-60081

Immediate Actions Required

Upgrade the Perl DBI module to version 1.651 or later on all systems that parse profile dumps
Audit automation and CI pipelines that ingest dbi.prof artifacts from external sources and quarantine untrusted files pending upgrade
Restrict filesystem permissions on directories where profile dump files are written so only trusted producers can create them

Patch Information

The fix ships in DBI 1.651 on CPAN. Reference the MetaCPAN Release Changes and the GitHub Security Advisory GHSA-ww49-w4mv-jrr4 for full details. The upstream commit is available at GitHub Patch Commit 6764e755.

Workarounds

Where immediate upgrade is not possible, set $DBI::ProfileData::MAX_PATH_DEPTH to a conservative value such as 256 before invoking the parser
Validate the path index column of dbi.prof files with an out-of-band script that rejects records exceeding an expected maximum
Run parsing jobs under process resource limits (ulimit -v) to contain memory exhaustion to a single worker

bash

# Upgrade DBI via cpanm and enforce a parser depth cap
cpanm DBI@1.651

# Defensive per-invocation cap for legacy callers
perl -MDBI::ProfileData -e '
  local $DBI::ProfileData::MAX_PATH_DEPTH = 256;
  my $prof = DBI::ProfileData->new(File => "dbi.prof");
'

# Contain memory usage of Perl workers
ulimit -v 1048576  # 1 GiB address space cap