new file mode 100644
@@ -0,0 +1,37 @@
+From b588d38661f00361bcf62b2665905ade844866ee Mon Sep 17 00:00:00 2001
+From: Robert Rothenberg <perl@rhizomnic.com>
+Date: Wed, 1 Jul 2026 22:31:56 +0100
+Subject: [PATCH] Load profile packages using Module::Load [CVE-2026-14380]
+
+CVE: CVE-2026-14380
+Upstream-Status: Backport [https://github.com/perl5-dbi/dbi/commit/b73d5d9901767fc1d16b6661ef08fbed4532e259]
+
+(cherry picked from commit b73d5d9901767fc1d16b6661ef08fbed4532e259)
+Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
+---
+ lib/DBI/Profile.pm | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/lib/DBI/Profile.pm b/lib/DBI/Profile.pm
+index f2cc886..4188462 100644
+--- a/lib/DBI/Profile.pm
++++ b/lib/DBI/Profile.pm
+@@ -679,6 +679,7 @@ use vars qw(@ISA @EXPORT @EXPORT_OK $VERSION);
+ use Exporter ();
+ use UNIVERSAL ();
+ use Carp;
++use Module::Load ();
+
+ use DBI qw(dbi_time dbi_profile dbi_profile_merge_nodes dbi_profile_merge);
+
+@@ -758,7 +759,9 @@ sub _auto_new {
+ }
+ }
+
+- eval "require $package" if $package; # silently ignores errors
++ eval {
++ Module::Load::load $package if $package; # silently ignores errors
++ };
+ $package ||= $class;
+
+ return $package->new(Path => \@Path, @args);
new file mode 100644
@@ -0,0 +1,65 @@
+From 54d3e792a236385930e387b28b6c8be779b8d7f7 Mon Sep 17 00:00:00 2001
+From: Robert Rothenberg <perl@rhizomnic.com>
+Date: Wed, 1 Jul 2026 23:03:34 +0100
+Subject: [PATCH] Add tests for CVE-2026-14380
+
+CVE: CVE-2026-14380
+Upstream-Status: Backport [https://github.com/perl5-dbi/dbi/commit/d982411aec73b3acfc4e9e465358bca9eb7fede8]
+
+(cherry picked from commit d982411aec73b3acfc4e9e465358bca9eb7fede8)
+Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
+---
+ t/40profile.t | 38 ++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 38 insertions(+)
+
+diff --git a/t/40profile.t b/t/40profile.t
+index 7a71b8f..5c72449 100644
+--- a/t/40profile.t
++++ b/t/40profile.t
+@@ -458,8 +458,46 @@ is("@$totals", "27.00 2.93 0.11 0.01 0.23 1023110000.00 1023110010.00",
+ 'merged time foo/bar');
+ is($total_time, 2.93, 'merged nodes foo/bar time');
+
++subtest "CVE-2026-14380" => sub {
++
++ {
++ my $marker = sprintf('dbi-test-payload-%u-%u-%u', time, $$, 1);
++ local $ENV{DBI_PROFILE} = payload_for($marker);
++ my $dbh = eval {
++ DBI->connect("dbi:Sponge:", "", "", { RaiseError => 0 })
++ };
++ ok !( -e "/tmp/$marker" ), "ENV DBI_PROFILE payload";
++ }
++
++ {
++ my $marker = sprintf('dbi-test-payload-%u-%u-%u', time, $$, 1);
++ my $dbh = DBI->connect("dbi:Sponge:", "", "", { RaiseError => 0 });
++ eval {
++ $dbh->{Profile} = payload_for($marker);
++ };
++ ok !( -e "/tmp/$marker" ), "Set Profile payload";
++ }
++
++ {
++ my $marker = sprintf('dbi-test-payload-%u-%u-%u', time, $$, 1);
++ my $payload = payload_for($marker);
++ my $dsn = "dbi:Sponge(Profile=>$payload):";
++ my $dbh = eval {
++ DBI->connect($dsn, "", "", { RaiseError => 0 })
++ };
++ ok !( -e "/tmp/$marker" ), "DSN payload";
++ }
++
++};
++
+ exit 0;
+
++sub payload_for {
++ my ($marker) = @_;
++ # Single-quoted q{...} so \x2f is literal backslash-x-2-f for split;
++ # the inner qq(...) re-interprets \x2f = / at eval-time.
++ return qq{2/system(qq(touch \\x2ftmp\\x2f$marker))};
++}
+
+ sub sanitize_tree {
+ my $data = shift;
new file mode 100644
@@ -0,0 +1,27 @@
+From cbd61112415aaa9db84d1af6d0bb3d0f61de8ce0 Mon Sep 17 00:00:00 2001
+From: Robert Rothenberg <perl@rhizomnic.com>
+Date: Sat, 4 Jul 2026 13:34:20 +0100
+Subject: [PATCH] t/40profile.t increase number of tests in the plan
+
+CVE: CVE-2026-14380
+Upstream-Status: Backport [https://github.com/perl5-dbi/dbi/commit/f94685f415b08ea4b1f183d48430c4583c1c07d0]
+
+(cherry picked from commit f94685f415b08ea4b1f183d48430c4583c1c07d0)
+Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
+---
+ t/40profile.t | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/t/40profile.t b/t/40profile.t
+index d736da7..ba24421 100644
+--- a/t/40profile.t
++++ b/t/40profile.t
+@@ -31,7 +31,7 @@ BEGIN {
+ if $Config{osvers} =~ /xen/ # eg 2.6.18-4-xen-amd64
+ and $ENV{AUTOMATED_TESTING};
+
+- plan tests => 60;
++ plan tests => 61;
+ }
+
+ $Data::Dumper::Indent = 1;
new file mode 100644
@@ -0,0 +1,56 @@
+From ef28126fbb8d918307b4995030028984ff8796f5 Mon Sep 17 00:00:00 2001
+From: Robert Rothenberg <perl@rhizomnic.com>
+Date: Mon, 6 Jul 2026 09:13:26 +0100
+Subject: [PATCH] Improve CVE-2026-14380 tests for Profile
+
+CVE: CVE-2026-14380
+Upstream-Status: Backport [https://github.com/perl5-dbi/dbi/commit/7949e551b3c7a8854926b6de84f6cc2ceafb2200]
+
+(cherry picked from commit 7949e551b3c7a8854926b6de84f6cc2ceafb2200)
+Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
+---
+ t/40profile.t | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/t/40profile.t b/t/40profile.t
+index 5c72449..d736da7 100644
+--- a/t/40profile.t
++++ b/t/40profile.t
+@@ -461,31 +461,34 @@ is($total_time, 2.93, 'merged nodes foo/bar time');
+ subtest "CVE-2026-14380" => sub {
+
+ {
+- my $marker = sprintf('dbi-test-payload-%u-%u-%u', time, $$, 1);
++ my $marker = sprintf('dbi-test-payload-%1.6f-%u-%u-%u', $], time, $$, 1);
+ local $ENV{DBI_PROFILE} = payload_for($marker);
+ my $dbh = eval {
+ DBI->connect("dbi:Sponge:", "", "", { RaiseError => 0 })
+ };
+ ok !( -e "/tmp/$marker" ), "ENV DBI_PROFILE payload";
++ unlink "/tmp/$marker" if -e "/tmp/$marker";
+ }
+
+ {
+- my $marker = sprintf('dbi-test-payload-%u-%u-%u', time, $$, 1);
++ my $marker = sprintf('dbi-test-payload-%1.6f-%u-%u-%u', $], time, $$, 2);
+ my $dbh = DBI->connect("dbi:Sponge:", "", "", { RaiseError => 0 });
+ eval {
+ $dbh->{Profile} = payload_for($marker);
+ };
+ ok !( -e "/tmp/$marker" ), "Set Profile payload";
++ unlink "/tmp/$marker" if -e "/tmp/$marker";
+ }
+
+ {
+- my $marker = sprintf('dbi-test-payload-%u-%u-%u', time, $$, 1);
++ my $marker = sprintf('dbi-test-payload-%1.6f-%u-%u-%u', $], time, $$, 3);
+ my $payload = payload_for($marker);
+ my $dsn = "dbi:Sponge(Profile=>$payload):";
+ my $dbh = eval {
+ DBI->connect($dsn, "", "", { RaiseError => 0 })
+ };
+ ok !( -e "/tmp/$marker" ), "DSN payload";
++ unlink "/tmp/$marker" if -e "/tmp/$marker";
+ }
+
+ };
@@ -13,6 +13,10 @@ SRC_URI = "http://search.cpan.org/CPAN/authors/id/T/TI/TIMB/DBI-${PV}.tar.gz \
file://CVE-2014-10402.patch \
file://CVE-2026-9698.patch \
file://CVE-2026-10879.patch \
+ file://CVE-2026-14380_p1.patch \
+ file://CVE-2026-14380_p2.patch \
+ file://CVE-2026-14380_p3.patch \
+ file://CVE-2026-14380_p4.patch \
"
SRC_URI[md5sum] = "352f80b1e23769c116082a90905d7398"
SRC_URI[sha256sum] = "8a2b993db560a2c373c174ee976a51027dd780ec766ae17620c20393d2e836fa"
@@ -43,6 +47,7 @@ RDEPENDS:${PN}:class-target = " \
perl-module-exporter-heavy \
perl-module-dynaloader \
perl-module-io-dir \
+ perl-module-load \
perl-module-scalar-util \
perl-module-universal \
"