{"id":"CVE-2026-78183","summary":"DBD::Pg version 3.21.0 for Perl has a heap out-of-bounds write in quote_float","details":"DBD::Pg version 3.21.0 for Perl has a heap out-of-bounds write in quote_float.\n\nquote_float() allocates the length of the string + 1, which is the size of the bare numeric symbol plus NULL.  But for special literals NaN, Inf, +Inf, -Inf, Infinity, +Infinity, -Infinity it emits the literal surrounded by quotes plus NULL, which is length + 3 bytes. Every recognised literal (case-insensitive) overflows by 2 bytes, a single quote and a NULL.\n\nThis can be reached by the $dbh-\u003equote method, for example\n\n    $dbh-\u003equote( \"Infinity\", DBI::SQL_NUMERIC ).\n\nThis regression was introduced in 3.21.0 by the quote.c rewrite.","aliases":["GHSA-785p-fw3v-r822"],"modified":"2026-08-28T14:33:08.516855Z","published":"2026-08-23T19:53:18.185Z","database_specific":{"cna_assigner":"CPANSec","cwe_ids":["CWE-787"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/78xxx/CVE-2026-78183.json"},"references":[{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2026/08/23/5"},{"type":"WEB","url":"https://cpan.org/modules"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/78xxx/CVE-2026-78183.json"},{"type":"ADVISORY","url":"https://github.com/bucardo/dbdpg/security/advisories/GHSA-785p-fw3v-r822"},{"type":"ADVISORY","url":"https://metacpan.org/release/TURNSTEP/DBD-Pg-3.21.1/source/Changes"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78183"},{"type":"FIX","url":"https://github.com/bucardo/dbdpg/commit/6d6f47ed2403cda55c82b1bad56e388ba7390065.patch"},{"type":"FIX","url":"https://github.com/bucardo/dbdpg/commit/adacf1de872326a465e13f9e4281a674ebcd227e"},{"type":"PACKAGE","url":"https://github.com/bucardo/dbdpg"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/bucardo/dbdpg","events":[{"introduced":"9459acf2885d82fe0a280f91b7724e756edc2cb1"},{"fixed":"6d6f47ed2403cda55c82b1bad56e388ba7390065"},{"fixed":"adacf1de872326a465e13f9e4281a674ebcd227e"}],"database_specific":{"source":["AFFECTED_FIELD","REFERENCES"],"extracted_events":[{"introduced":"3.21.0"},{"last_affected":"3.21.0"}]}}],"versions":["3.21.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-78183.json","vanir_signatures_modified":"2026-08-28T14:33:08Z","vanir_signatures":[{"source":"https://github.com/bucardo/dbdpg/commit/adacf1de872326a465e13f9e4281a674ebcd227e","target":{"file":"quote.c"},"deprecated":false,"digest":{"line_hashes":["88736849789814399384156949665245499971","52295972051545939122965921286676294826","289994358273457691108428502531074035722","285106593834986705162718191389325560899","33277386828226333679127444505666894564","269044468694596665520267025698352962831","91536485498761907572926334547978863833","225618080642519346126788035396504613569","160383065977863185577561988071048647058","304311534556212220896433895150108729434","20625648713936716259129236850864707190","291652989823985862140756746847263679840","111541788318914071352831149889056442610","268442310460700546109017157141448782279","131698176403925564394154658128268482007","295058155778334847070319286867899268482","156086454669680920828949960187938087751","109002948812519679920454872498497614294","335189699175186026668962694101567248614","195207103183394358349674610405461240247","142695552293298772448502071587628753055","298615094536408471794524992361138238018","279431526104126005026386040439520275269","101691142916621360220377238931980955115","229482830632713951324919039689283681064","95753755709637818435391281679608785361","207417322053802973200275765639675143762","310850151717085414078714000987107351257","104476287138422754292324880525399000819","335492283238322664005244251581038833928","211452491209197245258043782051877331820","279767985969480984779542996369882701180","303764393521512458536431938067513269269","52949432054010140864538828419033894040","97831050429163015382089359868746414725","206748157874208075842486832137569051921","168831167991651779227029196329809950588","331967787872432574714473549921516489129","254340003749826379557507670934284681146","147931519616369842776777408259187976214","23725698045441493172182551697195554726","336529575109257162848322066765364781321","331073425946318972392045223510173048135","272332896416150160582220955940917728152","114629044534705519359493946763990842973","325147639398243679438614137138826958704","101957699166739497219742348025593603890","52788487125234420121009531866545176092","59777923508742415686005817571774767002","338386302299556329072069594290567950188","38177092460089087241554659251817512050","18555071490205176648588596775556075428","189301144767057504634837824954197177074","51508349583462283056200482530305318138","153495871019556544571269021141410045295","68770418566203980423012734276987152239","222887450168796289411752323540704306076","95300143619441559426821985858061864163","280090034805547998876079272310695319216","54540900707669931022398179451290727368","245280087459643040796365856525028301420","317161654569205259906783203111750885866","280931977701712393131594156062723499861","106216734584053257830101021664556685032","70764167439778258130824356097150656615","308290462513392447518141590278918375149","42954939404612255177946646421424166557","140800193014126866692770844799250516876","274423225581928773674939743855148891099","241182273103677293812633919020289429481","339755319766202601135417235793423551563","28761674735591243491235278471024390685","2311700536643330811797237696289247390","265443166108510460725291971017418126199","167385397252057130902611564736244853807","71538290118594189492300843914691459385","317307715507007487625406086038575637538","199681223643758732261474903171022522224","116859227619751897955166851332107159359","82468790764929287684678836738929699243","31509135851163248954286945604912609839","172720088915923400653848124146097350645","91427150355898641581316920520524205956","48364594799504522254941751008546465593","135250776049046766086619660497695695840","250641399364527759663677914411571174738","245280087459643040796365856525028301420","317161654569205259906783203111750885866","181885845654808458952561019190652869290","206921877004440254330735780976014964210","250081158311817647199835578287320580280","21342786859705548101556899305870731268","60001590621568710659173274587382704988","218791431334142185505987452023649946542","252495835574707795528707220973652658792","188151929410446012752078796519562374249","228360724061745383857629335509699230035","225967620594616244289410498432586918283","130610312346852578600824320123752192936","261309845291886178374266775785829665067","137454560342407577992414852644928485948","247040102675111501691477594895938286486","142767157617746581253030891931171740864","190451583567574316006057970170714356530","116859227619751897955166851332107159359","82468790764929287684678836738929699243","31509135851163248954286945604912609839","172720088915923400653848124146097350645","91427150355898641581316920520524205956","48364594799504522254941751008546465593","135250776049046766086619660497695695840","250641399364527759663677914411571174738","245280087459643040796365856525028301420","317161654569205259906783203111750885866","66380413500625802734899104482751881980","222401920153864571398563254353099731489","134197113302482051489152790172769702908","232313943909709622520322938696407229255","60001590621568710659173274587382704988","218791431334142185505987452023649946542","252495835574707795528707220973652658792","188151929410446012752078796519562374249","228360724061745383857629335509699230035","225967620594616244289410498432586918283","92799918635983099830025134262666217626","245366070364451358841166507662808167873","255080403371943055759240121867486959880","149277929372664972861342631720970425502","79059540239233254486888501809183104070","29730038371820406158516571677764835430","116859227619751897955166851332107159359","82468790764929287684678836738929699243","31509135851163248954286945604912609839","172720088915923400653848124146097350645","91427150355898641581316920520524205956","48364594799504522254941751008546465593","135250776049046766086619660497695695840","250641399364527759663677914411571174738","245280087459643040796365856525028301420","317161654569205259906783203111750885866","53982503257224479058147780268056673489","43559670698508229065135161602698468035","24947694398227714126183767415586772396","79468772061510875513176970665661825821","232891792029821890671134570121053621509","14861245062317372965440630182178728565","153173941916552720040705988653281921922","41768953332694895836802763735523642134","222290901467326206397729935902800675451","331553088034000161542470990297917505605","44565866106169889749657738004072898319","239666808001657082625975787804734244650","256344984136673058080814963480196804197","163388919573214685597726497563375609897","160999075500616141703082383757525812813","325245364467787346738115329950529111328","22066906206441563576489629650347155494","37907724669570716962731628859604701389","254578584727697330728780063132573645738","230838414031520879130126258277467736667","129153047856070352727966395801143371498","303934104335161268410182306122043620231","249393998519137186076936637118421387336","192268804439942325985624406237530503029","315440562689747940885545152035101953366","176884476089975774325007405924583246775","81960626816994154670688080616348724301","92368619836369657098528412781041313301","64365177196628156048825607319086899027","312896449672064377606477461919730649608","97979177764491815654516620697035321241","275987017313533624810577927768853792381","152675027505927736910667569706182469474","103509596815423332728952765480332908134","192404653576530064599230644120206010274","217381225008423805430610666383006908357","195639369135225834307392171233235257725","304844725479183431224858827123175960982","241304430506717539361929136055151205099","322804841523325139468566276478235129323","48377492950785409893313568390563174074","137490854991383919392526653812679578843","236598638446722427904346641012276567597","334135304727248373441582751295603836626","22262962281774511874158831074615145961","51336253703931566471199256722637154624","91544948891514579160895522973653126558","260919388735880453851748051459138807909","221020140481460019975360434134043766190","316954640122111176605679717034932487240","111493745134444367933827054907709158404","54540900707669931022398179451290727368","15402229831604861925429782658951911962","99144497684013343742824389189559208527","67503411345538401239645851958381887707","42325796208294062716121862089815566513","230052577936255783068419981234333152735","141400084434855319113584019236138348416","240821830356948015211879162135857825847","92196328221084152358087724933459545356","8809231147314238177739076510270502947","333869526119742759240086724943945283869","12224557791076952979314015038926497243","234019688728677784706507250964841706074","182704026593470176642818702883703448121","97374845483842894486394352545635435620","146060644587060136071046831144962785631","2751456945546691114382792519703569515","1179680122204418965328430702017319199","79662652710650964762108593020754394353","151977815537932311754752099640881396373","288471495618808053325135220114154147550","51036020024943745177855821994830516812","159973988595151277393048288057620424838","280961691331175329005190810312258285966","133495909630533709636460275351016566527","253239086849232883584644927381236070998","334575746594404271781229658897437673690","272685690937703883116298285836000512785","322483643559800015761247434844202838660","162598153976578529614315192001271608050","226017653356508460779259348346897107730","33844813333072415860176187819256818138","10313627585647841706127024168116789601","331424275458438064894743920114239627090","74139423086257339567484959916273120449","109165169604700389495550982474673387612","205936238286290102459751759419463701599","62003649889741239275799155378055093871","247313341885451215457291284838534436383","124975830005667605749029685341528291112","103570191285972222368177703194035740163","11691614066953620720698823037662335355","334812018326470366594439826123291809126","201393707368870490900094860285014162534","153466053490298324985789969019056836011","147371906339621645047634962952938617282","51580563064681701028779201661006166599","307876206648975490493237349248846058026","300397032209236311272415183579515001296","283747173144493470080453898632182398664","101682905539797972836115222084923385694","22938976382863991152616139491447237919","282372294653622845247170672031509765046","17135050704690737071077583720585923115","332466005611745286985847424584159715779","156135144659700189466613345470400159096","65958726839375311461727336987286803823","338785177451936054010075223499866644786","319141772701250905580944258385573772273","219700366839042494938171423379429916916","324777347242744228695455930982970513341","102041069806754630152738457783759686071","170804623484218775206750823463832187908","178911697438562403877518168920627428212","172574544328899669912162501784727786424","200396572880431907217061965003813840252","335560066939160701983710768784428500474","132004351665248088145098340977319986543","324254715506120581593717537445621337432","23812618184611475026369747593929705814","218436698678170722254383483913765179504","105813092920250029273164654272031406970","301415772584326157231391040577592491757","338741883612059445601897453497770459023","303512297404115841658068938518047271356","209313874839765559039842092322908465951","221878413881329373273925357427147909033","100137005890715234154565673012202883198","315158276678414182507143465310183182013","177421877643851204973256945594492524852","76188678193488568017433584206304874481","71306432390911810436383075297212171364","140285465357665127597479746722225620994","253732306623946360630925553085048793968","188968443451294611507301741208008964785","137257543589444860113374091696611011778","11093400896674933944704106093877922581","20192599403616491514447262662600491102","124409553108649750496067897484463262818","115580739848513310498853038101228082155","147660503561458713771916891828275358305","192138240925732512173103215572899497065","55454257216117538150483372531728763258","105498844070321629451840046562657493863","111022508160775432615747860242771365364","180048933256755196518866946164517184787","220312851090464207911353641063821587085","86976025716098161905016380491067931923","147373597139993535765418367929096675003","300211212165949632496722558866213586867","327925423068281888897582839892055900690","76659198451915930752831029411302354711","288464784900273364443900224688696992170","148452576646239851611958374315399608111","110587092287060396067873023772096090997","56983973133851244273822470211195860710","236956414189435248255545784082057830564","136892854247809727734626719777232932208","9002799571895529847900017266592336275","215251240807137812775457698244704381053","20060667426936831444345765814900866785","163197476871029724173785580090383878521","332201703333358439800029318692874627766","105131887488147430321300830667016745092","272681793898648937901277965590119440090","243187596348876206560988276414896217736","256405710120376401055161743215120735831","211585938311233348777625127032973371307","2559374011937802995008184967761828477","1451027738684642841331078784855731246","324777347242744228695455930982970513341","102041069806754630152738457783759686071","276117784500567436474859049887090545788","314070331375163068027719110355063461631","194788472132438735373480861830271684836","278179064409152829149404769248769730692","276462330586347685744731426807834848641","174285382776315279671662730298883862224","163105009167051834172463021960462726006","226607705653453263272921839315159909153","248673931052212249680584196520215410305","187777444686127384876411221969037075558","106896994694419098484613603735027885149","202611986458351862694078539277663349155","101548513347041929259677754098058385548","208325369994101768895871722741136159649","42904266445278502448543121661426304790","302054847810684470099809978331095779540","131691604118193670475926381488240479344","251818213506853885689469967621844175478","311288830490579770197751713093017398516","172077725070596574582662488282109320416","263059479552233796789940482904357488283","50011606346947513090726073018910574496","249538480610466015988696192955689644306","15975001997143707645077954760591930324","191430784551018341557943875246047373251","102800274661655797876150054821941559816","336917870343213313258251447211994133336","227535516350551810862206735812677153056","277745797222111516646831825552901265065","330185836809864931125634626806136297615","326900100556850046472449266610640995456","153133134144246859324070154427172227460","205766048443497937997457511069457396060","20405993695520113232245431275852027500","241494369260159200538015450761451135031","8621721871671310633823765050426229629","38251311084302595210235110035014062563","319350865885090553279119774206318678999","180631876014542272953385275439380074031","305171156807161466090973784531221583410","82382961844442205078333435197582856558","55878745567028728695387666890002473201","227535516350551810862206735812677153056","277745797222111516646831825552901265065","330185836809864931125634626806136297615","86398021383052259299728617943664893885","103711623463548156740493340597046108392","287874795433631409829427770558839494017","317273519095867325753460634891355260486","292504417598996688038487005921220480732","176520114020244826979947078021820245123","50991610883061391419573218406527052400","60307262983111560838942825655777618391","319713013408982211266558070070893828982","81437517174340339916936260087611685923","300490843670792579712810382845164076227","307934327919462697501968276664215701644","293848754294278829652636594296806759253","26552775360826045139679017169496004941","149993947611805318639885557032261221349","297970011008806204404649115930245529432","125201025234927306677529488036703313415","299802192988290733096913891064745616931","114082597250878609001859463105621617226","258598765598523798578143118781348113579","261355106503429911602725216503632950961","106441483426255768194137953997977012598","188107630388648313473347205010115573438","273919359653597430485404401655635885024","244665651092789448291480281348162757341","64773909469055794162714236095435035710","105782608658381168960080003744027897460","60950640772421919950513711410644378716","84841535715106191996568224506504698600","274324322536143092249858668810416861156","130200514865034202594337885940029701571","220921112688103985061805278059182304117","105162251292631100971789444155213156410"],"threshold":0.9},"id":"CVE-2026-78183-1c1bc14f","signature_type":"Line","signature_version":"v1"},{"source":"https://github.com/bucardo/dbdpg/commit/6d6f47ed2403cda55c82b1bad56e388ba7390065","target":{"file":"dbdimp.c"},"deprecated":false,"digest":{"line_hashes":["168356145506936618266471011667251302754","197475376968004494955216647710804798718","55378893622279421486712140573707221013","289784870864133782166749512308841436127"],"threshold":0.9},"id":"CVE-2026-78183-3e2f7a9a","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["7634326395658214769400445182902573743","32891159184720543225265280726261404650","22698689533743418019952326643010978889","119452220112715952030448869578537711591","101860654086535935652580282153602684444","216705757144800065259144583301731858082","192858902588777730039207880731388674319","180463916992457926759341162642766155245","195759937303839884914122316860338853241","159939952982449162542617248519605834522","316560330656193863897371115342075062021","84553485863897285360968044654906931196","119897256959557503589096155296851620770","293968366543560226182435375016046262378","190463690122924680146455262718600809558","167535318170147457561688415338993842808","141683445817795442384128923804826585748","162933382220432254886049133114025186073","13821415953544387982965810933069097637","162553164055890706800131202464740679517","83694392825263711241995145319054672594","197039512835050266381029445731240090921","205822273903486487622272381047168209364","218842736640415133328168177040660241158","39616694226367753780815764989015841714","333255584179352395627440182744338893753","16799004082852232658114277733686471554","316225541940492066903759531069605974333","97190009040362095564695310765399518969","208483755700608807741218676155442979453","278438683497845021344347659243806739948","255533585527007972342440988282287462126","61905956686122883715541876527681465308","233723139939116354402109115017116664442","7199530055046117309912148329277100649","86656800189313405232493608984828257156","43187549203708022096907020826186786600","75063421635391491090024056161614175034","315499953371146950359375387868164282035","119808633242722729036636030209704042126","35877796570736221123485976278395687969","241731731946127963156720351204868346773","302370328756768635255565942549587387733","213194541949517644247384958984049916445","110642007108081421057192867912240518341","97279857360550156198705840092649014647","236016392083552883585971400807695483058","191328678731513658046836759933699235156","48459347485678194961102365932395632129","140782988106219195884517835532702106766","147431837254412075353967974115511087904","305174174520480813626719788629488954034","171763795207025725409632253320863091296"],"threshold":0.9},"id":"CVE-2026-78183-54a5631c","signature_type":"Line","signature_version":"v1","source":"https://github.com/bucardo/dbdpg/commit/adacf1de872326a465e13f9e4281a674ebcd227e","target":{"file":"types.c"}},{"digest":{"function_hash":"336204045702334992917321612037522722468","length":2648},"id":"CVE-2026-78183-655a986c","signature_type":"Function","signature_version":"v1","source":"https://github.com/bucardo/dbdpg/commit/6d6f47ed2403cda55c82b1bad56e388ba7390065","target":{"file":"dbdimp.c","function":"pg_destringify_array"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/bucardo/dbdpg/commit/6d6f47ed2403cda55c82b1bad56e388ba7390065","target":{"file":"quote.c","function":"_dequote_bytea_hex"},"deprecated":false,"digest":{"length":349,"function_hash":"223278589414786074573322246459300872481"},"id":"CVE-2026-78183-70e29d32"},{"deprecated":false,"digest":{"function_hash":"219253231287745750709821431147013670336","length":375},"id":"CVE-2026-78183-9319d213","signature_type":"Function","signature_version":"v1","source":"https://github.com/bucardo/dbdpg/commit/adacf1de872326a465e13f9e4281a674ebcd227e","target":{"file":"quote.c","function":"strncasecmp"}},{"signature_version":"v1","source":"https://github.com/bucardo/dbdpg/commit/6d6f47ed2403cda55c82b1bad56e388ba7390065","target":{"file":"quote.c"},"deprecated":false,"digest":{"line_hashes":["25831089568580034627272523744665581573","221741404429257545069100245317271221501","283910647042812526516527959069040574934","68579649571347971677354487597185670896","174723206414270765918921173334249696216","45858468713656064141304868999615748937","307947523551328754999641241086624911129","215984070741469371252132672270148534340"],"threshold":0.9},"id":"CVE-2026-78183-bc330a4b","signature_type":"Line"},{"target":{"file":"quote.h"},"deprecated":false,"digest":{"line_hashes":["308661538785988238380897969862815372440","139007254729342477318343778290076105010","326116837325570780557702071561151006607","131166686606257047252743665896801413552","248037277167566683586539036295017773909","39417397100710201520854251558893071766","15336835130294403650573607007748703655","177038072034541910210081650487114025094","314047188162230161633417152913363904981","67665816047262288998793117849196346966","233097318800080618876490429630321899946","33083130267052117609173694967181975387","217393858681581791358183617884811988262","153345480636839029615251243181914731807","299844054334704839514053981943065628232","122407861261607335357404248355708305503"],"threshold":0.9},"id":"CVE-2026-78183-f155ded0","signature_type":"Line","signature_version":"v1","source":"https://github.com/bucardo/dbdpg/commit/adacf1de872326a465e13f9e4281a674ebcd227e"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}