CVE-2026-78183: DBD::Pg version 3.21.0 for Perl has a heap out-of-bounds write in quote_float
DBD::Pg version 3.21.0 for Perl has a heap out-of-bounds write in quotefloat.
quotefloat() allocates the length of the string + 1, which is the size of the bare numeric symbol plus NULL. But for special literals NaN, Inf, +Inf, -Inf, Infinity, +Infinity, -Infinity it emits the literal surrounded by quotes plus NULL, which is length + 3 bytes. Every recognised literal (case-insensitive) overflows by 2 bytes, a single quote and a NULL.
This can be reached by the $dbh->quote method, for example
$dbh->quote( "Infinity", DBI::SQLNUMERIC ).
This regression was introduced in 3.21.0 by the quote.c rewrite.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
DBD::Pg (Perl)to a version that resolves this vulnerability.Fixed in 3.21.1
Event History
Frequently Asked Questions
What input is required to trigger the out-of-bounds write?
The application must call quote_float(), directly or through $dbh->quote with DBI::SQL_NUMERIC, using a recognized special numeric literal. Affected values are case-insensitive forms of NaN, Inf, +Inf, -Inf, Infinity, +Infinity, and -Infinity.
Are ordinary numeric values affected?
The described overflow occurs when quote_float() handles the listed special literals, because it adds quotes around them without allocating enough space. The data does not describe an overflow for ordinary numeric values.
Which version introduced the issue?
The issue was introduced in DBD::Pg 3.21.0 as part of the quote.c rewrite.
How can I identify potentially affected application code?
Review code paths that call $dbh->quote with DBI::SQL_NUMERIC, or otherwise invoke quote_float(), and determine whether attacker-controlled or otherwise untrusted values can be one of the recognized special floating-point literals.