CVE-2026-108518

DBI versions before 1.656 for Perl crash via type confusion in dbi profile when a database handle is destroyed under a Profile Path with an {attr} element.

An {attr} element names a database handle attribute, which dbi profile reads from the handle's inner hash. It expects the inner handle as a reference and dereferences it, but a handle that is being destroyed hands back the inner hash itself, so the dereference yields the hash's bucket array. A type check on that pointer usually fails and the call goes unprofiled. When the memory it addresses passes the check, the attribute lookup dereferences a NULL or invalid pointer and the process dies on SIGSEGV.

The Path is set by the application, by the Profile handle attribute, or by the DBI PROFILE environment variable, so DBI PROFILE={ImplementorClass} can crash an unmodified program.