CVE-2026-108518

A flaw was found in the perl-dbi package. A type confusion vulnerability in the profiling feature can lead to an invalid memory dereference, causing the application to crash and resulting in a Denial of Service (DoS). A user or attacker capable of supplying profiling configuration, such as through environment variables, can trigger this flaw during database handle destruction under specific profile path settings.

Moderate severity is assigned because exploitation requires local access or the capability to manipulate application execution environments, with the maximum impact limited to a denial of service via application crash. In typical Red Hat Enterprise Linux environments, DBI profiling is not active by default and requires explicit configuration through environment variables or handle attributes. Unmodified workloads running under default configurations without custom profiling paths remain unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.