EUVD-2026-64665
GHSA-6mq2-jf7v-pvjx
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Reachable only via a non-default quote()-with-numeric-type call on specific literals, so AC:H; a fixed 2-byte heap overflow most plausibly yields crashes (A:H) with limited C/I.
Primary rating from Vendor (CPANSec).
CVSS VectorVendor: CPANSec
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
DBD::Pg version 3.21.0 for Perl has a heap out-of-bounds write in quote_float.
quote_float() allocates the length of the string + 1, which is the size of the bare numeric symbol plus NULL. But for special literals NaN, Inf, +Inf, -Inf, Infinity, +Infinity, -Infinity it emits the literal surrounded by quotes plus NULL, which is length + 3 bytes. Every recognised literal (case-insensitive) overflows by 2 bytes, a single quote and a NULL.
This can be reached by the $dbh->quote method, for example
$dbh->quote( "Infinity", DBI::SQL_NUMERIC ).
This regression was introduced in 3.21.0 by the quote.c rewrite.
AnalysisAI
Heap out-of-bounds write in DBD::Pg 3.21.0, the Perl DBI driver for PostgreSQL, lets an attacker corrupt heap memory by passing special floating-point literals (NaN, Inf, +Inf, -Inf, Infinity, and signed variants) to the quote_float() routine, reachable through the common $dbh->quote(value, DBI::SQL_NUMERIC) path. The bug is a 2-byte overwrite (a single quote plus a NULL terminator) introduced by the 3.21.0 quote.c rewrite and fixed in 3.21.1. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the application to invoke DBD::Pg's quote functionality with a numeric SQL type - concretely $dbh->quote(value, DBI::SQL_NUMERIC) (or an equivalent SQL_FLOAT/numeric type binding) - on attacker-controlled input, and that input must be one of the recognised special literals NaN, Inf, +Inf, -Inf, Infinity, +Infinity, or -Infinity (matched case-insensitively). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The input CVSS is 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H), but the real-world signals argue for materially lower priority: EPSS is only 0.23% (14th percentile), there is no KEV listing, and SSVC records exploitation as none. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An application takes a user-supplied field and, believing it numeric, passes it through $dbh->quote($input, DBI::SQL_NUMERIC); an attacker submits the string 'Infinity' (or NaN/Inf variants, case-insensitive), causing quote_float() to write 2 bytes past its heap allocation. Repeated or carefully timed requests corrupt adjacent heap structures, most plausibly crashing the process (denial of service). … |
| Remediation | Vendor-released patch: 3.21.1 - upgrade DBD::Pg to 3.21.1 or later (fix confirmed in the CPAN Changes at https://metacpan.org/release/TURNSTEP/DBD-Pg-3.21.1/source/Changes and commit 6d6f47ed2403cda55c82b1bad56e388ba7390065). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit systems to identify Perl applications using DBD::Pg 3.21.0 by checking installed module versions (perl -MDBD::Pg -e 'print $DBD::Pg::VERSION'). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Memory Corruption
View allShare
External POC / Exploit Code
Leaving vuln.today