Recommended action

Review the upstream advisory, identify the affected product in your inventory, and apply the vendor update when one is available.

What this means

CVE-2026-60081 is listed in the HOL Guard supply-chain feed, but affected software is not mapped to a package. Review the upstream advisory for the affected product and vendor guidance. DBI::ProfileData versions before 1.651 for Perl do not limit the path index. The path index column of profile dump files is used to allocate an array of data for the parser. An unbounded value allows an attacker to specify a large index and consume available memory.

Affected software

Affected software not mapped. Review the upstream record for vendor-specific product and version guidance.

Evidence and references

• https://github.com/perl5-dbi/dbi/commit/6764e755e83ee1ebb1b40760e5b53eb50960bd7a.patch
• https://github.com/perl5-dbi/dbi/security/advisories/GHSA-ww49-w4mv-jrr4

Recommended action

Review the upstream advisory, identify the affected product in your inventory, and apply the vendor update when one is available.

What this means

CVE-2026-60081 is listed in the HOL Guard supply-chain feed, but affected software is not mapped to a package. Review the upstream advisory for the affected product and vendor guidance. DBI::ProfileData versions before 1.651 for Perl do not limit the path index. The path index column of profile dump files is used to allocate an array of data for the parser. An unbounded value allows an attacker to specify a large index and consume available memory.

Affected software

Affected software not mapped. Review the upstream record for vendor-specific product and version guidance.

Evidence and references

• https://github.com/perl5-dbi/dbi/commit/6764e755e83ee1ebb1b40760e5b53eb50960bd7a.patch
• https://github.com/perl5-dbi/dbi/security/advisories/GHSA-ww49-w4mv-jrr4