Ubuntu patches two Perl DBI module flaws, one with code execution risk

Canonical published security advisory USN-8912-1 on 12 October 2026, addressing two vulnerabilities in the Perl DBI (Database Interface) module, packaged as libdbi-perl. Anyone running Perl scripts in production that use DBI to access databases—a common scenario on legacy servers and management panels—should plan an update.

The two vulnerabilities

Harsh Raj Singhania discovered that the Perl DBI module failed to properly validate certain connection attributes, allowing an attacker to execute arbitrary code (CVE-2026-78030). Technical analyses published in independent vulnerability databases clarify the mechanism: DBD::DBM passes the dbm_type and dbm_mldbm connection attributes to require without checking whether the value refers to a valid module. In practice, require treats a path-like string as a literal filename and does not consult @INC, so the attribute determines which file Perl loads and executes. The result: if an application passes user input to these connection attributes, an attacker can force the server to execute a Perl script of their choosing.

The second vulnerability is less severe: the module incorrectly handled certain string operations, allowing an attacker to trigger a denial of service (CVE-2026-88816).

Patched versions and how to update

The command remains the same as always: sudo apt update && sudo apt upgrade. The target versions for the libdbi-perl package vary by release:

Ubuntu Release	Code name	Patched version
26.04 LTS	Resolute	1.647-1ubuntu0.26.04.4
24.04 LTS	Noble	1.643-4ubuntu0.4
22.04 LTS	Jammy	1.643-3ubuntu0.4
20.04 LTS	Focal	1.643-1ubuntu0.1+esm4 (requires Ubuntu Pro)
18.04 LTS	Bionic	1.640-1ubuntu0.3+esm4 (requires Ubuntu Pro)
16.04 LTS	Xenial	1.634-1ubuntu0.2+esm5 (requires Ubuntu Pro, Legacy Support add-on)
14.04 LTS	Trusty	1.630-1ubuntu0.1~esm9 (requires Ubuntu Pro, Legacy Support add-on)

For releases 20.04 and earlier, now outside standard support, the patch is available only through an active Ubuntu Pro subscription. Those managing machines on these versions without Pro should evaluate upgrading to a supported release, as these CVEs have no alternative update path.