Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-78183— DBD::Pg version 3.21.0 for Perl has a heap out-of-bounds write in quote_float

Quick assessment

Affected
CVE-2026-78183
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Perl 的 DBD::Pg 模块版本 3.21.0 中存在一个堆缓冲区越界写入漏洞，发生在 函数中。 函数在分配内存时，仅分配了字符串长度加 1 字节的内存，这足以容纳普通的数字符号及其结尾的空字符（NULL）。然而，当输入为特殊字面量（如 NaN、Inf、+Inf、-Inf、Infinity、+Infinity、-Infinity）时，该函数会输出用引号括起来的字面量内容，再加上一个空字符，这实际需要比原始字符串长度多 3 字节（即两个引号字符和一个空字符）。因此，对于任何被识别的字面量（不区分大小写），都会发

AI Predicted 7.5 Difficulty: Moderate

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

I. Basic Information for CVE-2026-78183

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
DBD::Pg version 3.21.0 for Perl has a heap out-of-bounds write in quote_float
Source: CVE Program / CVE List V5
Vulnerability Description
DBD::Pg version 3.21.0 for Perl has a heap out-of-bounds write in quote_float. quote_float() allocates the length of the string + 1, which is the size of the bare numeric symbol plus NULL. But for special literals NaN, Inf, +Inf, -Inf, Infinity, +Infinity, -Infinity it emits the literal surrounded by quotes plus NULL, which is length + 3 bytes. Every recognised literal (case-insensitive) overflows by 2 bytes, a single quote and a NULL. This can be reached by the $dbh->quote method, for example $dbh->quote( "Infinity", DBI::SQL_NUMERIC ). This regression was introduced in 3.21.0 by the quote.c rewrite.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存写
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
- - 3.21.0 -

II. Public POCs for CVE-2026-78183

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-78183

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-78183 (2)

Vendor Advisories for CVE-2026-78183 (1)

IV. Related Vulnerabilities

Same weakness: CWE-787

V. Comments for CVE-2026-78183

No comments yet

Leave a comment