According to the versions of the perl-DBI packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    A flaw was found in DBI. This is a fix for a partial fix for CVE-2026-14380 for RHEL 9.8.z and 10.2.z.

    For a detailed Statement, Description and Mitigation please reffer to the original     https://access.redhat.com/security/cve/cve-2026-19546.(CVE-2026-19546)

    DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile.

    When a string is assigned to a DBI handle's Profile attribute, DBI splits it into path, package and     arguments, and interpolates the package part in a string eval with no validation of the package name.

    Any caller-influenced value that reaches the Profile attribute is therefore arbitrary Perl code execution,     including calls to run system commands.

    The Profile attribute can be set from three different sources that can carry untrusted data: the     DBI_PROFILE environment variable, a direct attribute assignment, and a DSN driver-attribute clause     dbi:Driver(Profile=SPEC):db.

    An attacker controlling any of those inputs runs arbitrary Perl in the host process. The strongest remote     position is a network-exposed DBI::Gofer / DBI::ProxyServer whose per-request DSN reaches the Profile     attribute, letting a client execute code on the broker host.(CVE-2026-14380)

    DBI versions before 1.652 for Perl allow a heap out-of-bounds write on 32-bit perl via an integer     wraparound in the output buffer size computed by preparse.

    preparse reserves its output buffer with `newSV(strlen(statement) * 7 + 16)`, budgeting seven output bytes     per input byte for the longest ':p99999' expansion. The product is computed in STRLEN, which is 32 bits     wide on a 32-bit perl build, so a statement of 613,566,757 bytes multiplies to 4,294,967,299, wraps modulo     2^32 to 3, and reserves 19 bytes. The parser then copies the statement out through a raw pointer with no     capacity check, writing the whole 585 MB input past the end of the allocation. The 99,999 placeholder     limit does not bound this path, which is reached by ordinary non-placeholder content.

    Any caller that passes an untrusted statement of that length to preparse on a 32-bit perl gets a heap out-     of-bounds write of attacker controlled bytes. Builds with a 64-bit STRLEN are not affected, since the wrap     there needs a statement of about 2.3 exabytes.(CVE-2026-73193)

    DBI versions before 1.650 for Perl read one byte out-of-bounds in preparse when deleting an initial SQL     comment.

    The preparse method normalises SQL and removes comments. When the SQL starts with a comment line, the     deletion of that line during normalisation led to an out-of-bounds read by one byte. The result is a fault     on memory-hardened builds and nondeterministic newline retention on normal builds.(CVE-2026-14740)

    DBI versions before 1.652 for Perl allow a heap out-of-bounds write via an unvalidated numeric placeholder     that sets the binder counter in preparse.

    preparse reserves seven output bytes per input byte, the width of the longest ':p99999' expansion. The     ':N' branch parses the number with `atoi(src)` and assigns it to the binder counter with no range check,     so a statement containing ':2147483648' leaves the counter negative (-2147483648 with glibc, where atoi     wraps). Each following '?' then expands through `sprintf(start, ':p%d', idx++)` to ':p-2147483648', 14     bytes with the terminating NUL where the buffer budgets 7. The placeholder limit added in 1.650 tests the     counter against 99,999, which a negative counter passes.

    Any caller that preparses an untrusted statement into ':pN' style placeholders gets a heap out-of-bounds     write that grows with the number of '?' marks following the poisoned placeholder. The '?' and '%s' return     styles compare the parsed number against the expected sequence and error out, and are     unaffected.(CVE-2026-73194)

Tenable has extracted the preceding description block directly from the EulerOS perl-DBI security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:66179 advisory.

    * DBI: Incomplete fix for CVE-2026-14380 DBI: Arbitrary code execution via caller-influenced Profile     attribute (CVE-2026-19546)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:65887 advisory.

    * DBI: Incomplete fix for CVE-2026-14380 DBI: Arbitrary code execution via caller-influenced Profile     attribute (CVE-2026-19546)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:66179 advisory.

    * DBI: Incomplete fix for CVE-2026-14380 DBI: Arbitrary code execution via caller-influenced Profile     attribute (CVE-2026-19546)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-126157 advisory.

    A flaw was found in DBI. This is a fix for a partial fix for CVE-2026-14380 for RHEL 9.8.z and 10.2.z.

    For a detailed Statement, Description and Mitigation please reffer to the original     https://access.redhat.com/security/cve/cve-2026-19546.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1789485312 advisory.

  - A flaw was found in DBI. This is a fix for a partial fix for CVE-2026-14380 for RHEL 9.8.z and 10.2.z. For     a detailed Statement, Description and Mitigation please reffer to the original     https://access.redhat.com/security/cve/cve-2026-19546. (CVE-2026-19546)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:66179 advisory.

    DBI is a database access Application Programming Interface (API) for the Perl Language. The DBI API     Specification defines a set of functions, variables and conventions that provide a consistent database     interface independent of the actual database being used.

    Security Fix(es):

    * DBI: Incomplete fix for CVE-2026-14380 DBI: Arbitrary code execution via caller-influenced Profile     attribute (CVE-2026-19546)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1789482518 advisory.

  - A flaw was found in DBI. This is a fix for a partial fix for CVE-2026-14380 for RHEL 9.8.z and 10.2.z. For     a detailed Statement, Description and Mitigation please reffer to the original     https://access.redhat.com/security/cve/cve-2026-19546. (CVE-2026-19546)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
376737	EulerOS 2.0 SP12 : perl-DBI (EulerOS-SA-2026-4514)	Nessus	Huawei Local Security Checks	2026/11/6	2026/11/6	critical
376767	EulerOS 2.0 SP12 : perl-DBI (EulerOS-SA-2026-4437)	Nessus	Huawei Local Security Checks	2026/11/6	2026/11/6	critical
344511	AlmaLinux 9 : perl-DBI (ALSA-2026:66179)	Nessus	Alma Linux Local Security Checks	2026/9/10	2026/9/11	high
344460	RockyLinux 10 : perl-DBI (RLSA-2026:65887)	Nessus	Rocky Linux Local Security Checks	2026/9/10	2026/9/11	high
344829	RockyLinux 9 : perl-DBI (RLSA-2026:66179)	Nessus	Rocky Linux Local Security Checks	2026/9/11	2026/9/18	high
353318	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: perl-DBI (UTSA-2026-126157)	Nessus	Unity Linux Local Security Checks	2026/9/30	2026/9/30	high
360158	AlmaLinux 9.6 [TuxCare] Security Update: perl-DBI (ALMALINUX9.6:CLSA-2026:1789485312)	Nessus	Alma Linux Local Security Checks	2026/10/1	2026/10/1	high
344419	RHEL 9 : perl-DBI (RHSA-2026:66179)	Nessus	Red Hat Local Security Checks	2026/9/9	2026/9/11	high
352398	AlmaLinux 9.2 [TuxCare] Security Update: perl-DBI (ALMALINUX9.2:CLSA-2026:1789482518)	Nessus	Alma Linux Local Security Checks	2026/9/30	2026/9/30	high

検出

プラグインの検索

critical

critical

high

high

high

high

high

high

high