# CVE-2026-78183: DBD::Pg heap out-of-bounds write in quote_float

Source: https://junglewise.ai/threats/cve-2026-78183-dbd-pg-heap-out-of-bounds-write-in-quote-float  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-23. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-78183 · Severity: critical · CVSS 9.8 · Published 2026-08-23

DBD::Pg is a database interface module for Perl that allows applications to connect to and query PostgreSQL databases. A memory allocation bug in the quote_float function causes a heap buffer overflow when quoting special floating-point literals (NaN, Infinity, etc.), which can be triggered by database queries. An attacker could exploit this to crash the application or potentially execute arbitrary code.

Vendors: [CPAN](https://junglewise.ai/threats/vendors/cpan).

## Quick answers

**Is CVE-2026-78183 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-78183 being exploited in the wild.

**How severe is CVE-2026-78183?** Critical severity, with a CVSS score of 9.8, published 23 August 2026.

**Which products and versions are affected?** CPAN DBD::Pg 3.21.0.

**Is there a fix for CVE-2026-78183?** A patch was published on 2026-08-23. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-78183 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-78183?** Check whether you run CPAN DBD::Pg at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a heap out-of-bounds write in the quote_float() function in DBD::Pg 3.21.0, introduced during a rewrite of quote.c. The function allocates insufficient memory (length + 1 bytes) to store quoted special float literals (NaN, Inf, +Inf, -Inf, Infinity, +Infinity, -Infinity), which require length + 3 bytes (opening quote, string content, closing quote, and NULL terminator). Every recognized literal overflows by 2 bytes, writing past the allocated buffer. The vulnerability can be triggered via the $dbh->quote() method with a SQL_NUMERIC type specifier, requiring no special privileges but direct application access to the vulnerable code path. The patch (commit 6d6f47ed) corrects the allocation size in quote.c line 375 from length + 1 to length + 3.

## Affected products

- CPAN DBD::Pg 3.21.0

## Timeline

- 2026-08-23: disclosed
- 2026-08-23: patched

## References

- [https://cpan.org/modules](https://cpan.org/modules)
- [https://github.com/bucardo/dbdpg/commit/6d6f47ed2403cda55c82b1bad56e388ba7390065.patch](https://github.com/bucardo/dbdpg/commit/6d6f47ed2403cda55c82b1bad56e388ba7390065.patch)