SUSE Patches Two Perl DBI Flaws That Can Crash Database Driver Processes
SUSE has published advisory SUSE-SU-2026:4805-1, a moderate-rated security update for the perl-DBI package released on 21 October 2026. The update resolves two vulnerabilities, CVE-2026-88815 and CVE-2026-88816, both tracked internally as bsc#1283055 and bsc#1283056. Affected platforms include Basesystem Module 15-SP7, openSUSE Leap 15.6, SUSE Linux Enterprise Desktop 15 SP7, SUSE Linux Enterprise Real Time 15 SP7, SUSE Linux Enterprise Server 15 SP7, and SUSE Linux Enterprise Server for SAP Applications 15 SP7. The fixed build is perl-DBI-1.647.0-150600.12.26.1, along with its matching debuginfo and debugsource packages.
Both issues share the same root cause: a numeric value is incorrectly treated as a string inside the module's internals. For CVE-2026-88815 the mishandling occurs in the sql_type_cast_svpv routine, while CVE-2026-88816 affects FetchHashKeyName. In each case the result described by the vendor is a process crash rather than data disclosure or code execution. SUSE scores both flaws 6.9 under CVSS v4.0 and 6.2 under CVSS v3.1, with locally reachable vectors and an availability-only impact; NVD agrees on 6.2 for CVE-2026-88815 but rates CVE-2026-88816 higher at 7.5 with a network attack vector. Beyond naming the two affected functions, the vendor has not published exploitation details or proof-of-concept code.
perl-DBI is the standard database interface layer for Perl and sits underneath a large amount of long-running back-office automation, reporting jobs, and middleware on enterprise Linux estates, including SAP-oriented SLES builds. A reliably triggerable crash in that layer translates into service interruption for whatever depends on it, and repeated crashes in a daemonised consumer can become a denial-of-service condition rather than a one-off fault. Neither flaw affects confidentiality or integrity according to the published CVSS vectors, which keeps the blast radius narrow. Current exploitation likelihood is low: FIRST EPSS puts CVE-2026-88815 at a 0.2 percent probability of exploitation in the next 30 days and CVE-2026-88816 at 0.6 percent, and no in-the-wild activity has been reported against either.
Attack Surface
Database, Server OS
Tactics
Impact
Techniques
- T1499 – Endpoint Denial of Service
- T1499.004 – Application or System Exploitation
SuperPRO's Threat Countermeasures Procedures
- Upgrade perl-DBI to 1.647.0-150600.12.26.1 or later on all affected hosts, which is the fixed build SUSE ships for CVE-2026-88815 and CVE-2026-88816.
- On openSUSE Leap 15.6 apply the patch with: zypper in -t patch SUSE-2026-4805, or use YaST online_update / zypper patch.
- On Basesystem Module 15-SP7 apply the patch with: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP7-2026-4805.
- Inventory SUSE Linux Enterprise Server 15 SP7, Server for SAP Applications 15 SP7, Desktop 15 SP7, Real Time 15 SP7 and openSUSE Leap 15.6 systems with: rpm -q perl-DBI, and flag any build older than 1.647.0-150600.12.26.1 for scheduling.
- Also refresh the matching perl-DBI-debuginfo and perl-DBI-debugsource packages to 1.647.0-150600.12.26.1 on systems where they are installed, so debug symbols stay aligned with the patched binary.
- Restart long-running Perl daemons, mod_perl workers and SAP-related batch jobs that link perl-DBI after patching, since in-memory processes continue running the vulnerable code until recycled.
- Add monitoring for abnormal termination of Perl database workers (segfault entries in journalctl or systemd service Result=signal) and alert on repeated restarts, which is the observable symptom of the crash condition described in bsc#1283055 and bsc#1283056.
