GHSA-ww49-w4mv-jrr4
CVE Information
DBI::ProfileData parses a profile-dump file line by line. A + N key line supplies the path slot N, which is trusted directly into $#path = $index at ProfileData.pm:290 with no upper bound. A single line such as + 100000000 x expands @path into a giant sparse array, which the next data line then materialises via join("\0", @path) (:317) and copies with push(@$nodes, [ @data, @path ]) (:326) — a tiny input to a large-memory/large-logging primitive (CWE-400).
The parser input is a file path. dbiprof passes its command-line arguments straight into DBI::ProfileData->new(Files => ...) (dbiprof.PL:64), so any workflow that runs the profile parser over a dump crossing a trust boundary — support bundles, CI/observability pipelines, hosted profile-report tooling — is exposed.
Impact is denial of service against the parsing process: a 137-byte profile with + 10000000 exits under a 128 MB cgroup; a smaller + 100000 produces ~99,998 warnings and ~99 MB RSS growth from a few bytes. No RCE and not a normal database-input path, hence low severity.
Fix: reject a zero/negative or implausibly large index before mutating @path (a generous MAX_PATH_DEPTH with a malformed-profile croak). One-line guard at ProfileData.pm:290.