CVE-2026-60081: DBI::ProfileData versions before 1.651 for Perl do not limit the path index. The path index column of profile dump files is used to allocate an array of data for the parser. An un

highCVSS 7.5CVE-2026-60081

DBI::ProfileData versions before 1.651 for Perl do not limit the path index. The path index column of profile dump files is used to allocate an array of data for the parser. An unbounded value allows an attacker to specify a large index and consume available memory.

Details

Source: NVD Recent CVEs (US · database · site)
Severity: high — CVSS 7.5
Published: 2026-07-14
Last updated: 2026-07-15
Exploitation: Not in CISA KEV at last sync

Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-60081

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-600810.38% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 31% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-60081	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

highCVE-2026-60081: DBI::ProfileData versions before 1.651 for Perl do not limit the path indexmsrc

Recent advisories for DBI

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

criticalCVE-2026-60082: DBI versions before 1.651 for Perl do not enforce statement handle consistency with the row. W…nvd · 2026-07-14
criticalCVE-2026-15043: DBI::SQL::Nano versions from 1.42 before 1.651 for Perl have inverted = SQL operators on text.…nvd · 2026-07-14
highCVE-2026-14739: DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an…msrc · 2026-07-14
highCVE-2026-60081: DBI::ProfileData versions before 1.651 for Perl do not limit the path indexmsrc · 2026-07-14
highCVE-2026-14380: DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Prof…msrc · 2026-07-14
criticalCVE-2026-15043: DBI::SQL::Nano versions from 1.42 before 1.651 for Perl have inverted = SQL operators on textmsrc · 2026-07-14