CVE-2026-78183
- Source
- https://cve.org/CVERecord?id=CVE-2026-78183
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-78183.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-78183
- Aliases
-
- GHSA-785p-fw3v-r822
- Published
- 2026-08-23T19:53:18.185Z
- Modified
- 2026-08-28T14:33:08.516855Z
- Severity
-
- 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- DBD::Pg version 3.21.0 for Perl has a heap out-of-bounds write in quote_float
- Details
-
DBD::Pg version 3.21.0 for Perl has a heap out-of-bounds write in quote_float.
quote_float() allocates the length of the string + 1, which is the size of the bare numeric symbol plus NULL. But for special literals NaN, Inf, +Inf, -Inf, Infinity, +Infinity, -Infinity it emits the literal surrounded by quotes plus NULL, which is length + 3 bytes. Every recognised literal (case-insensitive) overflows by 2 bytes, a single quote and a NULL.
This can be reached by the $dbh->quote method, for example
$dbh->quote( "Infinity", DBI::SQL_NUMERIC ).This regression was introduced in 3.21.0 by the quote.c rewrite.
- Database specific
{ "cna_assigner": "CPANSec", "cwe_ids": [ "CWE-787" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/78xxx/CVE-2026-78183.json" }- References
-
- http://www.openwall.com/lists/oss-security/2026/08/23/5
- https://cpan.org/modules
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/78xxx/CVE-2026-78183.json
- https://github.com/bucardo/dbdpg/security/advisories/GHSA-785p-fw3v-r822
- https://metacpan.org/release/TURNSTEP/DBD-Pg-3.21.1/source/Changes
- https://nvd.nist.gov/vuln/detail/CVE-2026-78183
- https://github.com/bucardo/dbdpg/commit/6d6f47ed2403cda55c82b1bad56e388ba7390065.patch
- https://github.com/bucardo/dbdpg/commit/adacf1de872326a465e13f9e4281a674ebcd227e
- https://github.com/bucardo/dbdpg
Affected packages
Git / github.com/bucardo/dbdpg
Database specific
vanir_signatures_modified
"2026-08-28T14:33:08Z"
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-78183.json"
vanir_signatures
[
{
"deprecated": false,
"target": {
"file": "quote.c"
},
"signature_type": "Line",
"source": "https://github.com/bucardo/dbdpg/commit/adacf1de872326a465e13f9e4281a674ebcd227e",
"digest": {
"line_hashes": [
"88736849789814399384156949665245499971",
"52295972051545939122965921286676294826",
"289994358273457691108428502531074035722",
"285106593834986705162718191389325560899",
"33277386828226333679127444505666894564",
"269044468694596665520267025698352962831",
"91536485498761907572926334547978863833",
"225618080642519346126788035396504613569",
"160383065977863185577561988071048647058",
"304311534556212220896433895150108729434",
"20625648713936716259129236850864707190",
"291652989823985862140756746847263679840",
"111541788318914071352831149889056442610",
"268442310460700546109017157141448782279",
"131698176403925564394154658128268482007",
"295058155778334847070319286867899268482",
"156086454669680920828949960187938087751",
"109002948812519679920454872498497614294",
"335189699175186026668962694101567248614",
"195207103183394358349674610405461240247",
"142695552293298772448502071587628753055",
"298615094536408471794524992361138238018",
"279431526104126005026386040439520275269",
"101691142916621360220377238931980955115",
"229482830632713951324919039689283681064",
"95753755709637818435391281679608785361",
"207417322053802973200275765639675143762",
"310850151717085414078714000987107351257",
"104476287138422754292324880525399000819",
"335492283238322664005244251581038833928",
"211452491209197245258043782051877331820",
"279767985969480984779542996369882701180",
"303764393521512458536431938067513269269",
"52949432054010140864538828419033894040",
"97831050429163015382089359868746414725",
"206748157874208075842486832137569051921",
"168831167991651779227029196329809950588",
"331967787872432574714473549921516489129",
"254340003749826379557507670934284681146",
"147931519616369842776777408259187976214",
"23725698045441493172182551697195554726",
"336529575109257162848322066765364781321",
"331073425946318972392045223510173048135",
"272332896416150160582220955940917728152",
"114629044534705519359493946763990842973",
"325147639398243679438614137138826958704",
"101957699166739497219742348025593603890",
"52788487125234420121009531866545176092",
"59777923508742415686005817571774767002",
"338386302299556329072069594290567950188",
"38177092460089087241554659251817512050",
"18555071490205176648588596775556075428",
"189301144767057504634837824954197177074",
"51508349583462283056200482530305318138",
"153495871019556544571269021141410045295",
"68770418566203980423012734276987152239",
"222887450168796289411752323540704306076",
"95300143619441559426821985858061864163",
"280090034805547998876079272310695319216",
"54540900707669931022398179451290727368",
"245280087459643040796365856525028301420",
"317161654569205259906783203111750885866",
"280931977701712393131594156062723499861",
"106216734584053257830101021664556685032",
"70764167439778258130824356097150656615",
"308290462513392447518141590278918375149",
"42954939404612255177946646421424166557",
"140800193014126866692770844799250516876",
"274423225581928773674939743855148891099",
"241182273103677293812633919020289429481",
"339755319766202601135417235793423551563",
"28761674735591243491235278471024390685",
"2311700536643330811797237696289247390",
"265443166108510460725291971017418126199",
"167385397252057130902611564736244853807",
"71538290118594189492300843914691459385",
"317307715507007487625406086038575637538",
"199681223643758732261474903171022522224",
"116859227619751897955166851332107159359",
"82468790764929287684678836738929699243",
"31509135851163248954286945604912609839",
"172720088915923400653848124146097350645",
"91427150355898641581316920520524205956",
"48364594799504522254941751008546465593",
"135250776049046766086619660497695695840",
"250641399364527759663677914411571174738",
"245280087459643040796365856525028301420",
"317161654569205259906783203111750885866",
"181885845654808458952561019190652869290",
"206921877004440254330735780976014964210",
"250081158311817647199835578287320580280",
"21342786859705548101556899305870731268",
"60001590621568710659173274587382704988",
"218791431334142185505987452023649946542",
"252495835574707795528707220973652658792",
"188151929410446012752078796519562374249",
"228360724061745383857629335509699230035",
"225967620594616244289410498432586918283",
"130610312346852578600824320123752192936",
"261309845291886178374266775785829665067",
"137454560342407577992414852644928485948",
"247040102675111501691477594895938286486",
"142767157617746581253030891931171740864",
"190451583567574316006057970170714356530",
"116859227619751897955166851332107159359",
"82468790764929287684678836738929699243",
"31509135851163248954286945604912609839",
"172720088915923400653848124146097350645",
"91427150355898641581316920520524205956",
"48364594799504522254941751008546465593",
"135250776049046766086619660497695695840",
"250641399364527759663677914411571174738",
"245280087459643040796365856525028301420",
"317161654569205259906783203111750885866",
"66380413500625802734899104482751881980",
"222401920153864571398563254353099731489",
"134197113302482051489152790172769702908",
"232313943909709622520322938696407229255",
"60001590621568710659173274587382704988",
"218791431334142185505987452023649946542",
"252495835574707795528707220973652658792",
"188151929410446012752078796519562374249",
"228360724061745383857629335509699230035",
"225967620594616244289410498432586918283",
"92799918635983099830025134262666217626",
"245366070364451358841166507662808167873",
"255080403371943055759240121867486959880",
"149277929372664972861342631720970425502",
"79059540239233254486888501809183104070",
"29730038371820406158516571677764835430",
"116859227619751897955166851332107159359",
"82468790764929287684678836738929699243",
"31509135851163248954286945604912609839",
"172720088915923400653848124146097350645",
"91427150355898641581316920520524205956",
"48364594799504522254941751008546465593",
"135250776049046766086619660497695695840",
"250641399364527759663677914411571174738",
"245280087459643040796365856525028301420",
"317161654569205259906783203111750885866",
"53982503257224479058147780268056673489",
"43559670698508229065135161602698468035",
"24947694398227714126183767415586772396",
"79468772061510875513176970665661825821",
"232891792029821890671134570121053621509",
"14861245062317372965440630182178728565",
"153173941916552720040705988653281921922",
"41768953332694895836802763735523642134",
"222290901467326206397729935902800675451",
"331553088034000161542470990297917505605",
"44565866106169889749657738004072898319",
"239666808001657082625975787804734244650",
"256344984136673058080814963480196804197",
"163388919573214685597726497563375609897",
"160999075500616141703082383757525812813",
"325245364467787346738115329950529111328",
"22066906206441563576489629650347155494",
"37907724669570716962731628859604701389",
"254578584727697330728780063132573645738",
"230838414031520879130126258277467736667",
"129153047856070352727966395801143371498",
"303934104335161268410182306122043620231",
"249393998519137186076936637118421387336",
"192268804439942325985624406237530503029",
"315440562689747940885545152035101953366",
"176884476089975774325007405924583246775",
"81960626816994154670688080616348724301",
"92368619836369657098528412781041313301",
"64365177196628156048825607319086899027",
"312896449672064377606477461919730649608",
"97979177764491815654516620697035321241",
"275987017313533624810577927768853792381",
"152675027505927736910667569706182469474",
"103509596815423332728952765480332908134",
"192404653576530064599230644120206010274",
"217381225008423805430610666383006908357",
"195639369135225834307392171233235257725",
"304844725479183431224858827123175960982",
"241304430506717539361929136055151205099",
"322804841523325139468566276478235129323",
"48377492950785409893313568390563174074",
"137490854991383919392526653812679578843",
"236598638446722427904346641012276567597",
"334135304727248373441582751295603836626",
"22262962281774511874158831074615145961",
"51336253703931566471199256722637154624",
"91544948891514579160895522973653126558",
"260919388735880453851748051459138807909",
"221020140481460019975360434134043766190",
"316954640122111176605679717034932487240",
"111493745134444367933827054907709158404",
"54540900707669931022398179451290727368",
"15402229831604861925429782658951911962",
"99144497684013343742824389189559208527",
"67503411345538401239645851958381887707",
"42325796208294062716121862089815566513",
"230052577936255783068419981234333152735",
"141400084434855319113584019236138348416",
"240821830356948015211879162135857825847",
"92196328221084152358087724933459545356",
"8809231147314238177739076510270502947",
"333869526119742759240086724943945283869",
"12224557791076952979314015038926497243",
"234019688728677784706507250964841706074",
"182704026593470176642818702883703448121",
"97374845483842894486394352545635435620",
"146060644587060136071046831144962785631",
"2751456945546691114382792519703569515",
"1179680122204418965328430702017319199",
"79662652710650964762108593020754394353",
"151977815537932311754752099640881396373",
"288471495618808053325135220114154147550",
"51036020024943745177855821994830516812",
"159973988595151277393048288057620424838",
"280961691331175329005190810312258285966",
"133495909630533709636460275351016566527",
"253239086849232883584644927381236070998",
"334575746594404271781229658897437673690",
"272685690937703883116298285836000512785",
"322483643559800015761247434844202838660",
"162598153976578529614315192001271608050",
"226017653356508460779259348346897107730",
"33844813333072415860176187819256818138",
"10313627585647841706127024168116789601",
"331424275458438064894743920114239627090",
"74139423086257339567484959916273120449",
"109165169604700389495550982474673387612",
"205936238286290102459751759419463701599",
"62003649889741239275799155378055093871",
"247313341885451215457291284838534436383",
"124975830005667605749029685341528291112",
"103570191285972222368177703194035740163",
"11691614066953620720698823037662335355",
"334812018326470366594439826123291809126",
"201393707368870490900094860285014162534",
"153466053490298324985789969019056836011",
"147371906339621645047634962952938617282",
"51580563064681701028779201661006166599",
"307876206648975490493237349248846058026",
"300397032209236311272415183579515001296",
"283747173144493470080453898632182398664",
"101682905539797972836115222084923385694",
"22938976382863991152616139491447237919",
"282372294653622845247170672031509765046",
"17135050704690737071077583720585923115",
"332466005611745286985847424584159715779",
"156135144659700189466613345470400159096",
"65958726839375311461727336987286803823",
"338785177451936054010075223499866644786",
"319141772701250905580944258385573772273",
"219700366839042494938171423379429916916",
"324777347242744228695455930982970513341",
"102041069806754630152738457783759686071",
"170804623484218775206750823463832187908",
"178911697438562403877518168920627428212",
"172574544328899669912162501784727786424",
"200396572880431907217061965003813840252",
"335560066939160701983710768784428500474",
"132004351665248088145098340977319986543",
"324254715506120581593717537445621337432",
"23812618184611475026369747593929705814",
"218436698678170722254383483913765179504",
"105813092920250029273164654272031406970",
"301415772584326157231391040577592491757",
"338741883612059445601897453497770459023",
"303512297404115841658068938518047271356",
"209313874839765559039842092322908465951",
"221878413881329373273925357427147909033",
"100137005890715234154565673012202883198",
"315158276678414182507143465310183182013",
"177421877643851204973256945594492524852",
"76188678193488568017433584206304874481",
"71306432390911810436383075297212171364",
"140285465357665127597479746722225620994",
"253732306623946360630925553085048793968",
"188968443451294611507301741208008964785",
"137257543589444860113374091696611011778",
"11093400896674933944704106093877922581",
"20192599403616491514447262662600491102",
"124409553108649750496067897484463262818",
"115580739848513310498853038101228082155",
"147660503561458713771916891828275358305",
"192138240925732512173103215572899497065",
"55454257216117538150483372531728763258",
"105498844070321629451840046562657493863",
"111022508160775432615747860242771365364",
"180048933256755196518866946164517184787",
"220312851090464207911353641063821587085",
"86976025716098161905016380491067931923",
"147373597139993535765418367929096675003",
"300211212165949632496722558866213586867",
"327925423068281888897582839892055900690",
"76659198451915930752831029411302354711",
"288464784900273364443900224688696992170",
"148452576646239851611958374315399608111",
"110587092287060396067873023772096090997",
"56983973133851244273822470211195860710",
"236956414189435248255545784082057830564",
"136892854247809727734626719777232932208",
"9002799571895529847900017266592336275",
"215251240807137812775457698244704381053",
"20060667426936831444345765814900866785",
"163197476871029724173785580090383878521",
"332201703333358439800029318692874627766",
"105131887488147430321300830667016745092",
"272681793898648937901277965590119440090",
"243187596348876206560988276414896217736",
"256405710120376401055161743215120735831",
"211585938311233348777625127032973371307",
"2559374011937802995008184967761828477",
"1451027738684642841331078784855731246",
"324777347242744228695455930982970513341",
"102041069806754630152738457783759686071",
"276117784500567436474859049887090545788",
"314070331375163068027719110355063461631",
"194788472132438735373480861830271684836",
"278179064409152829149404769248769730692",
"276462330586347685744731426807834848641",
"174285382776315279671662730298883862224",
"163105009167051834172463021960462726006",
"226607705653453263272921839315159909153",
"248673931052212249680584196520215410305",
"187777444686127384876411221969037075558",
"106896994694419098484613603735027885149",
"202611986458351862694078539277663349155",
"101548513347041929259677754098058385548",
"208325369994101768895871722741136159649",
"42904266445278502448543121661426304790",
"302054847810684470099809978331095779540",
"131691604118193670475926381488240479344",
"251818213506853885689469967621844175478",
"311288830490579770197751713093017398516",
"172077725070596574582662488282109320416",
"263059479552233796789940482904357488283",
"50011606346947513090726073018910574496",
"249538480610466015988696192955689644306",
"15975001997143707645077954760591930324",
"191430784551018341557943875246047373251",
"102800274661655797876150054821941559816",
"336917870343213313258251447211994133336",
"227535516350551810862206735812677153056",
"277745797222111516646831825552901265065",
"330185836809864931125634626806136297615",
"326900100556850046472449266610640995456",
"153133134144246859324070154427172227460",
"205766048443497937997457511069457396060",
"20405993695520113232245431275852027500",
"241494369260159200538015450761451135031",
"8621721871671310633823765050426229629",
"38251311084302595210235110035014062563",
"319350865885090553279119774206318678999",
"180631876014542272953385275439380074031",
"305171156807161466090973784531221583410",
"82382961844442205078333435197582856558",
"55878745567028728695387666890002473201",
"227535516350551810862206735812677153056",
"277745797222111516646831825552901265065",
"330185836809864931125634626806136297615",
"86398021383052259299728617943664893885",
"103711623463548156740493340597046108392",
"287874795433631409829427770558839494017",
"317273519095867325753460634891355260486",
"292504417598996688038487005921220480732",
"176520114020244826979947078021820245123",
"50991610883061391419573218406527052400",
"60307262983111560838942825655777618391",
"319713013408982211266558070070893828982",
"81437517174340339916936260087611685923",
"300490843670792579712810382845164076227",
"307934327919462697501968276664215701644",
"293848754294278829652636594296806759253",
"26552775360826045139679017169496004941",
"149993947611805318639885557032261221349",
"297970011008806204404649115930245529432",
"125201025234927306677529488036703313415",
"299802192988290733096913891064745616931",
"114082597250878609001859463105621617226",
"258598765598523798578143118781348113579",
"261355106503429911602725216503632950961",
"106441483426255768194137953997977012598",
"188107630388648313473347205010115573438",
"273919359653597430485404401655635885024",
"244665651092789448291480281348162757341",
"64773909469055794162714236095435035710",
"105782608658381168960080003744027897460",
"60950640772421919950513711410644378716",
"84841535715106191996568224506504698600",
"274324322536143092249858668810416861156",
"130200514865034202594337885940029701571",
"220921112688103985061805278059182304117",
"105162251292631100971789444155213156410"
],
"threshold": 0.9
},
"signature_version": "v1",
"id": "CVE-2026-78183-1c1bc14f"
},
{
"deprecated": false,
"target": {
"file": "dbdimp.c"
},
"signature_type": "Line",
"source": "https://github.com/bucardo/dbdpg/commit/6d6f47ed2403cda55c82b1bad56e388ba7390065",
"digest": {
"line_hashes": [
"168356145506936618266471011667251302754",
"197475376968004494955216647710804798718",
"55378893622279421486712140573707221013",
"289784870864133782166749512308841436127"
],
"threshold": 0.9
},
"signature_version": "v1",
"id": "CVE-2026-78183-3e2f7a9a"
},
{
"deprecated": false,
"target": {
"file": "types.c"
},
"signature_type": "Line",
"source": "https://github.com/bucardo/dbdpg/commit/adacf1de872326a465e13f9e4281a674ebcd227e",
"digest": {
"line_hashes": [
"7634326395658214769400445182902573743",
"32891159184720543225265280726261404650",
"22698689533743418019952326643010978889",
"119452220112715952030448869578537711591",
"101860654086535935652580282153602684444",
"216705757144800065259144583301731858082",
"192858902588777730039207880731388674319",
"180463916992457926759341162642766155245",
"195759937303839884914122316860338853241",
"159939952982449162542617248519605834522",
"316560330656193863897371115342075062021",
"84553485863897285360968044654906931196",
"119897256959557503589096155296851620770",
"293968366543560226182435375016046262378",
"190463690122924680146455262718600809558",
"167535318170147457561688415338993842808",
"141683445817795442384128923804826585748",
"162933382220432254886049133114025186073",
"13821415953544387982965810933069097637",
"162553164055890706800131202464740679517",
"83694392825263711241995145319054672594",
"197039512835050266381029445731240090921",
"205822273903486487622272381047168209364",
"218842736640415133328168177040660241158",
"39616694226367753780815764989015841714",
"333255584179352395627440182744338893753",
"16799004082852232658114277733686471554",
"316225541940492066903759531069605974333",
"97190009040362095564695310765399518969",
"208483755700608807741218676155442979453",
"278438683497845021344347659243806739948",
"255533585527007972342440988282287462126",
"61905956686122883715541876527681465308",
"233723139939116354402109115017116664442",
"7199530055046117309912148329277100649",
"86656800189313405232493608984828257156",
"43187549203708022096907020826186786600",
"75063421635391491090024056161614175034",
"315499953371146950359375387868164282035",
"119808633242722729036636030209704042126",
"35877796570736221123485976278395687969",
"241731731946127963156720351204868346773",
"302370328756768635255565942549587387733",
"213194541949517644247384958984049916445",
"110642007108081421057192867912240518341",
"97279857360550156198705840092649014647",
"236016392083552883585971400807695483058",
"191328678731513658046836759933699235156",
"48459347485678194961102365932395632129",
"140782988106219195884517835532702106766",
"147431837254412075353967974115511087904",
"305174174520480813626719788629488954034",
"171763795207025725409632253320863091296"
],
"threshold": 0.9
},
"signature_version": "v1",
"id": "CVE-2026-78183-54a5631c"
},
{
"deprecated": false,
"target": {
"function": "pg_destringify_array",
"file": "dbdimp.c"
},
"signature_type": "Function",
"source": "https://github.com/bucardo/dbdpg/commit/6d6f47ed2403cda55c82b1bad56e388ba7390065",
"digest": {
"length": 2648.0,
"function_hash": "336204045702334992917321612037522722468"
},
"signature_version": "v1",
"id": "CVE-2026-78183-655a986c"
},
{
"deprecated": false,
"target": {
"function": "_dequote_bytea_hex",
"file": "quote.c"
},
"signature_type": "Function",
"source": "https://github.com/bucardo/dbdpg/commit/6d6f47ed2403cda55c82b1bad56e388ba7390065",
"digest": {
"length": 349.0,
"function_hash": "223278589414786074573322246459300872481"
},
"signature_version": "v1",
"id": "CVE-2026-78183-70e29d32"
},
{
"deprecated": false,
"target": {
"function": "strncasecmp",
"file": "quote.c"
},
"signature_type": "Function",
"source": "https://github.com/bucardo/dbdpg/commit/adacf1de872326a465e13f9e4281a674ebcd227e",
"digest": {
"length": 375.0,
"function_hash": "219253231287745750709821431147013670336"
},
"signature_version": "v1",
"id": "CVE-2026-78183-9319d213"
},
{
"deprecated": false,
"target": {
"file": "quote.c"
},
"signature_type": "Line",
"source": "https://github.com/bucardo/dbdpg/commit/6d6f47ed2403cda55c82b1bad56e388ba7390065",
"digest": {
"line_hashes": [
"25831089568580034627272523744665581573",
"221741404429257545069100245317271221501",
"283910647042812526516527959069040574934",
"68579649571347971677354487597185670896",
"174723206414270765918921173334249696216",
"45858468713656064141304868999615748937",
"307947523551328754999641241086624911129",
"215984070741469371252132672270148534340"
],
"threshold": 0.9
},
"signature_version": "v1",
"id": "CVE-2026-78183-bc330a4b"
},
{
"deprecated": false,
"target": {
"file": "quote.h"
},
"signature_type": "Line",
"source": "https://github.com/bucardo/dbdpg/commit/adacf1de872326a465e13f9e4281a674ebcd227e",
"digest": {
"line_hashes": [
"308661538785988238380897969862815372440",
"139007254729342477318343778290076105010",
"326116837325570780557702071561151006607",
"131166686606257047252743665896801413552",
"248037277167566683586539036295017773909",
"39417397100710201520854251558893071766",
"15336835130294403650573607007748703655",
"177038072034541910210081650487114025094",
"314047188162230161633417152913363904981",
"67665816047262288998793117849196346966",
"233097318800080618876490429630321899946",
"33083130267052117609173694967181975387",
"217393858681581791358183617884811988262",
"153345480636839029615251243181914731807",
"299844054334704839514053981943065628232",
"122407861261607335357404248355708305503"
],
"threshold": 0.9
},
"signature_version": "v1",
"id": "CVE-2026-78183-f155ded0"
}
]