CVE-2026-60081 DBI::ProfileData versions before 1.651 for Perl do not limit the path index
An attacker can cause a denial of service by providing a large path index in profile dump files, leading to excessive memory consumption.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-60081?
CVE-2026-60081 is a high-severity denial of service vulnerability in HMBRAND DBI::ProfileData, published on 14 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
DBI::ProfileData versions before 1.651 for Perl do not limit the path index.
The path index column of profile dump files is used to allocate an array of data for the parser. An unbounded value allows an attacker to specify a large index and consume available memory.
Weakness: CWE-770
Which versions are affected by CVE-2026-60081?
How do I fix CVE-2026-60081?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-60081 being exploited?
There is no known exploitation of CVE-2026-60081 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2026-60081, AZL-92427, BELL-CVE-2026-60081, DEBIAN-CVE-2026-60081, ECHO-f107-7c08-d5d8, GHSA-ww49-w4mv-jrr4 and 2 more.