Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-111879— DBI versions before 1.656 for Perl hang on a later open of a DBD::DBM table because a failed open_data does not release the table's lock

Quick assessment

Affected
CVE-2026-111879
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Perl 的 DBI 模块 1.656 版本之前，当尝试再次打开一个 DBD::DBM 表时，程序会出现挂起（hang）现象。其根本原因是：当 操作失败时，未能释放该表的锁。 具体机制如下： 在创建表的锁文件并对其进行独占 锁定（用于 CREATE 操作）之后，才执行可能触发 （抛出异常）的检查步骤，例如： 值不是有效的模块名、 操作失败，或数据文件缺失。由于异常在表对象被 （赋予对象属性）之前就被抛出，因此没有任何代码执行到释放锁的步骤，导致持有打开文件描述符的元数据仍被缓存在数据库句柄中。 和 的值来源于

AI Predicted 5.9 Difficulty: Moderate

Possible ATT&CK Techniques 1 AI

T1499 · Endpoint Denial of Service

I. Basic Information for CVE-2026-111879

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
DBI versions before 1.656 for Perl hang on a later open of a DBD::DBM table because a failed open_data does not release the table's lock
Source: CVE Program / CVE List V5
Vulnerability Description
DBI versions before 1.656 for Perl hang on a later open of a DBD::DBM table because a failed open_data does not release the table's lock. open_data creates the table's lock file and takes an exclusive flock on it for a CREATE, before the checks that can croak: a dbm_mldbm value that is not a module name, a failing tie, or a missing data file. The croak unwinds before the table object is blessed, so nothing releases the lock, and the meta data holding the open descriptor stays cached on the database handle. The dbm_mldbm and dbm_type values come from the DSN or the connect attributes, so a caller that chooses the serializer or the storage backend can trigger the failure. The flock has no timeout, so a later open of that table (even through a separate database handle) blocks for as long as the handle holding the stale lock lives, in the same process or any other.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
加锁机制不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
- - 0 ~ 1.656 -

II. Public POCs for CVE-2026-111879

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-111879

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-111879 (1)

Vendor Advisories for CVE-2026-111879 (1)

Other References for CVE-2026-111879 (1)

IV. Related Vulnerabilities

Same weakness: CWE-667

V. Comments for CVE-2026-111879

No comments yet

Leave a comment