Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-78183: Perl DBD::Pg 3.21.0 may write beyond memory when handling special numbers
CVE-2026-78183 · published 11 days ago
Summary
If your Perl applications use DBD::Pg version 3.21.0 to talk to PostgreSQL, certain special numeric values like Infinity or NaN can cause the software to write a few extra bytes into memory. This memory error could lead to unstable behavior or crashes. Update to a newer release of DBD::Pg or apply the vendor's fix to avoid the issue.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:16.04:LTS | canonical | libdbd-pg-perl | All versions |
Original advisory text
DBD::Pg version 3.21.0 for Perl has a heap out-of-bounds write in quote_float. quote_float() allocates the length of the string + 1, which is the size of the bare numeric symbol plus NULL. But for...
DBD::Pg version 3.21.0 for Perl has a heap out-of-bounds write in quote_float. quote_float() allocates the length of the string + 1, which is the size of the bare numeric symbol plus NULL. But for special literals NaN, Inf, +Inf, -Inf, Infinity, +Infinity, -Infinity it emits the literal surrounded by quotes plus NULL, which is length + 3 bytes. Every recognised literal (case-insensitive) overflows by 2 bytes, a single quote and a NULL. This can be reached by the $dbh->quote method, for example $dbh->quote( "Infinity", DBI::SQL_NUMERIC ). This regression was introduced in 3.21.0 by the quote.c rewrite.
References
- https://github.com/bucardo/dbdpg/commit/6d6f47ed2403cda55c82b1bad56e388ba7390065...
- https://github.com/bucardo/dbdpg/commit/adacf1de872326a465e13f9e4281a674ebcd227e
- https://metacpan.org/release/TURNSTEP/DBD-Pg-3.21.1/source/Changes
- http://www.openwall.com/lists/oss-security/2026/08/23/5
- https://cpan.org/modules URL
- https://github.com/bucardo/dbdpg Product
- https://nvd.nist.gov/vuln/detail/CVE-2026-78183 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/78xxx/CVE-2026-78183... Vendor Advisory
- https://ubuntu.com/security/CVE-2026-78183 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-78183 Third Party Advisory
- https://lists.security.metacpan.org/cve-announce/msg/42931839/ Third Party Advisory
- https://github.com/bucardo/dbdpg/security/advisories/GHSA-785p-fw3v-r822 Third Party Advisory
Severity
9.8
Critical
Exploitation
EPSS <1%
Type
CWE-787Out-of-bounds Write
Timeline
Published23 Aug 2026
Updated3 Sep 2026
First seen23 Aug 2026
Sources
CVE-2026-78183 · NVD
CVE-2026-78183 · MITRE
GHSA-785p-fw3v-r822 · GHSA
CVE-2026-78183 · OSV
UBUNTU-CVE-2026-78183 · OSV
Monitor software like this
Free during beta