CVE-2026-78183

DBD::Pg version 3.21.0 for Perl has a heap out-of-bounds write in quote_float. quote_float() allocates the length of the string + 1, which is the size of the bare numeric symbol plus NULL. But for special literals NaN, Inf, +Inf, -Inf, Infinity, +Infinity, -Infinity it emits the literal surrounded by quotes plus NULL, which is length + 3 bytes. Every recognised literal (case-insensitive) overflows by 2 bytes, a single quote and a NULL. This can be reached by the $dbh->quote method, for example $dbh->quote( "Infinity", DBI::SQL_NUMERIC ). This regression was introduced in 3.21.0 by the quote.c rewrite.

• CWE-787

• https://github.com/bucardo/dbdpg/commit/6d6f47ed2403cda55c82b1bad56e388ba7390065.patch
• https://github.com/bucardo/dbdpg/commit/adacf1de872326a465e13f9e4281a674ebcd227e
• https://github.com/bucardo/dbdpg/security/advisories/GHSA-785p-fw3v-r822
• https://metacpan.org/release/TURNSTEP/DBD-Pg-3.21.1/source/Changes
• https://www.openwall.com/lists/oss-security/2026/08/23/5

Published

Aug 23, 2026

Last Modified

Aug 26, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-78178A vulnerability was determined in jQWidgets up to 24.0.1. Th…7.3
• CVE-2026-78179A vulnerability was identified in rexrainbow phaser3-rex-not…6.3
• CVE-2026-7818Deserialization of untrusted data (CWE-502) in pgAdmin 4 Fil…7.8
• CVE-2026-78180A security flaw has been discovered in alibaba-fusion next u…7.3
• CVE-2026-78181A weakness has been identified in ractivejs ractive up to 1.…7.3
• CVE-2026-78182A security vulnerability has been detected in Shenzhen Gongj…7.3
• CVE-2026-78185A vulnerability was detected in itsourcecode Sales and Inven…6.3
• CVE-2026-78186A flaw has been found in Open5GS up to 2.8.0. This affects a…4.3
• CVE-2026-78187A vulnerability has been found in Piwigo 16.3.0. This impact…3.1
• CVE-2026-7819Symbolic-link path traversal (CWE-61, CWE-22) in pgAdmin 4 F…8.1
• CVE-2026-78195Rejected reason: Rejecting as a duplicate of CVE-2026-78047
• CVE-2026-78196A security flaw has been discovered in achorein expo-share-i…4.4