CVE-2026-78183

Name of the Vulnerable Software and Affected Versions DBD::Pg version 3.21.0

Description A heap out-of-bounds write exists in the quote float() function. The function allocates memory based on the string length plus one byte for the NULL terminator. However, when processing special literals such as NaN, Inf, +Inf, -Inf, Infinity, +Infinity, or -Infinity, it writes the literal enclosed in quotes plus the NULL terminator, resulting in a write that exceeds the allocated buffer by two bytes. This issue can be triggered via the $dbh->quote method when using the DBI::SQL NUMERIC type.

Recommendations As a temporary workaround, avoid using the $dbh->quote method with DBI::SQL NUMERIC for the affected special literals in version 3.21.0. At the moment, there is no information about a newer version that contains a fix for this vulnerability.