Memory leak in the dequote_bytea function in quote.c in the DBD::Pg (aka DBD-Pg or…
Priority LOW 27CWE-200Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- None · None · Partial
- Fix status
- Fixed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-200.
Summary
Memory leak in the dequote_bytea function in quote.c in the DBD::Pg (aka DBD-Pg or libdbd-pg-perl) module before 2.0.0 for Perl allows context-dependent attackers to cause a denial of service (memory consumption) by fetching data with BYTEA columns.
Why it matters now
EPSS 0.01969 80th percentileScored 2026-11-07
Fix Fixed Red Hat: 2 advisories
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 57
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:debian:libdbd-pg-perl:*:*:*:*:*:*:*:* | up to 1.4.9 | Vulnerable | Debian |
| cpe:2.3:a:debian:libdbd-pg-perl:0.1:*:*:*:*:*:*:* | 0.1 | Vulnerable | Debian |
| cpe:2.3:a:debian:libdbd-pg-perl:0.2:*:*:*:*:*:*:* | 0.2 | Vulnerable | Debian |
| cpe:2.3:a:debian:libdbd-pg-perl:0.3:*:*:*:*:*:*:* | 0.3 | Vulnerable | Debian |
| cpe:2.3:a:debian:libdbd-pg-perl:0.4:*:*:*:*:*:*:* | 0.4 | Vulnerable | Debian |
| cpe:2.3:a:debian:libdbd-pg-perl:0.5:*:*:*:*:*:*:* | 0.5 | Vulnerable | Debian |
| cpe:2.3:a:debian:libdbd-pg-perl:0.51:*:*:*:*:*:*:* | 0.51 | Vulnerable | Debian |
| cpe:2.3:a:debian:libdbd-pg-perl:0.52:*:*:*:*:*:*:* | 0.52 | Vulnerable | Debian |
| cpe:2.3:a:debian:libdbd-pg-perl:0.61:*:*:*:*:*:*:* | 0.61 | Vulnerable | Debian |
| cpe:2.3:a:debian:libdbd-pg-perl:0.62:*:*:*:*:*:*:* | 0.62 | Vulnerable | Debian |
- cpe:2.3:a:debian:libdbd-pg-perl:*:*:*:*:*:*:*:* Versions up to 1.4.9 Vulnerable ·Debian
- cpe:2.3:a:debian:libdbd-pg-perl:0.1:*:*:*:*:*:*:* Versions 0.1 Vulnerable ·Debian
- cpe:2.3:a:debian:libdbd-pg-perl:0.2:*:*:*:*:*:*:* Versions 0.2 Vulnerable ·Debian
- cpe:2.3:a:debian:libdbd-pg-perl:0.3:*:*:*:*:*:*:* Versions 0.3 Vulnerable ·Debian
- cpe:2.3:a:debian:libdbd-pg-perl:0.4:*:*:*:*:*:*:* Versions 0.4 Vulnerable ·Debian
- cpe:2.3:a:debian:libdbd-pg-perl:0.5:*:*:*:*:*:*:* Versions 0.5 Vulnerable ·Debian
- cpe:2.3:a:debian:libdbd-pg-perl:0.51:*:*:*:*:*:*:* Versions 0.51 Vulnerable ·Debian
- cpe:2.3:a:debian:libdbd-pg-perl:0.52:*:*:*:*:*:*:* Versions 0.52 Vulnerable ·Debian
- cpe:2.3:a:debian:libdbd-pg-perl:0.61:*:*:*:*:*:*:* Versions 0.61 Vulnerable ·Debian
- cpe:2.3:a:debian:libdbd-pg-perl:0.62:*:*:*:*:*:*:* Versions 0.62 Vulnerable ·Debian
Show 47 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:debian:libdbd-pg-perl:0.63:*:*:*:*:*:*:* | 0.63 | Vulnerable | Debian |
| cpe:2.3:a:debian:libdbd-pg-perl:0.64:*:*:*:*:*:*:* | 0.64 | Vulnerable | Debian |
| cpe:2.3:a:debian:libdbd-pg-perl:0.65:*:*:*:*:*:*:* | 0.65 | Vulnerable | Debian |
| cpe:2.3:a:debian:libdbd-pg-perl:0.66:*:*:*:*:*:*:* | 0.66 | Vulnerable | Debian |
| cpe:2.3:a:debian:libdbd-pg-perl:0.67:*:*:*:*:*:*:* | 0.67 | Vulnerable | Debian |
| cpe:2.3:a:debian:libdbd-pg-perl:0.68:*:*:*:*:*:*:* | 0.68 | Vulnerable | Debian |
| cpe:2.3:a:debian:libdbd-pg-perl:0.69:*:*:*:*:*:*:* | 0.69 | Vulnerable | Debian |
| cpe:2.3:a:debian:libdbd-pg-perl:0.70:*:*:*:*:*:*:* | 0.70 | Vulnerable | Debian |
| cpe:2.3:a:debian:libdbd-pg-perl:0.71:*:*:*:*:*:*:* | 0.71 | Vulnerable | Debian |
| cpe:2.3:a:debian:libdbd-pg-perl:0.72:*:*:*:*:*:*:* | 0.72 | Vulnerable | Debian |
| cpe:2.3:a:debian:libdbd-pg-perl:0.73:*:*:*:*:*:*:* | 0.73 | Vulnerable | Debian |
| cpe:2.3:a:debian:libdbd-pg-perl:0.80:*:*:*:*:*:*:* | 0.80 | Vulnerable | Debian |
| cpe:2.3:a:debian:libdbd-pg-perl:0.81:*:*:*:*:*:*:* | 0.81 | Vulnerable | Debian |
| cpe:2.3:a:debian:libdbd-pg-perl:0.82:*:*:*:*:*:*:* | 0.82 | Vulnerable | Debian |
| cpe:2.3:a:debian:libdbd-pg-perl:0.83:*:*:*:*:*:*:* | 0.83 | Vulnerable | Debian |
| cpe:2.3:a:debian:libdbd-pg-perl:0.84:*:*:*:*:*:*:* | 0.84 | Vulnerable | Debian |
| cpe:2.3:a:debian:libdbd-pg-perl:0.85:*:*:*:*:*:*:* | 0.85 | Vulnerable | Debian |
| cpe:2.3:a:debian:libdbd-pg-perl:0.86:*:*:*:*:*:*:* | 0.86 | Vulnerable | Debian |
| cpe:2.3:a:debian:libdbd-pg-perl:0.87:*:*:*:*:*:*:* | 0.87 | Vulnerable | Debian |
| cpe:2.3:a:debian:libdbd-pg-perl:0.88:*:*:*:*:*:*:* | 0.88 | Vulnerable | Debian |
| cpe:2.3:a:debian:libdbd-pg-perl:0.89:*:*:*:*:*:*:* | 0.89 | Vulnerable | Debian |
| cpe:2.3:a:debian:libdbd-pg-perl:0.90:*:*:*:*:*:*:* | 0.90 | Vulnerable | Debian |
| cpe:2.3:a:debian:libdbd-pg-perl:0.91:*:*:*:*:*:*:* | 0.91 | Vulnerable | Debian |
| cpe:2.3:a:debian:libdbd-pg-perl:0.92:*:*:*:*:*:*:* | 0.92 | Vulnerable | Debian |
| cpe:2.3:a:debian:libdbd-pg-perl:0.93:*:*:*:*:*:*:* | 0.93 | Vulnerable | Debian |
| cpe:2.3:a:debian:libdbd-pg-perl:0.94:*:*:*:*:*:*:* | 0.94 | Vulnerable | Debian |
| cpe:2.3:a:debian:libdbd-pg-perl:0.95:*:*:*:*:*:*:* | 0.95 | Vulnerable | Debian |
| cpe:2.3:a:debian:libdbd-pg-perl:0.96:*:*:*:*:*:*:* | 0.96 | Vulnerable | Debian |
| cpe:2.3:a:debian:libdbd-pg-perl:0.97:*:*:*:*:*:*:* | 0.97 | Vulnerable | Debian |
| cpe:2.3:a:debian:libdbd-pg-perl:0.98:*:*:*:*:*:*:* | 0.98 | Vulnerable | Debian |
| cpe:2.3:a:debian:libdbd-pg-perl:0.99:*:*:*:*:*:*:* | 0.99 | Vulnerable | Debian |
| cpe:2.3:a:debian:libdbd-pg-perl:1.0.0:*:*:*:*:*:*:* | 1.0.0 | Vulnerable | Debian |
| cpe:2.3:a:debian:libdbd-pg-perl:1.0.1:*:*:*:*:*:*:* | 1.0.1 | Vulnerable | Debian |
| cpe:2.3:a:debian:libdbd-pg-perl:1.2.0:*:*:*:*:*:*:* | 1.2.0 | Vulnerable | Debian |
| cpe:2.3:a:debian:libdbd-pg-perl:1.2.1:*:*:*:*:*:*:* | 1.2.1 | Vulnerable | Debian |
| cpe:2.3:a:debian:libdbd-pg-perl:1.2.2:*:*:*:*:*:*:* | 1.2.2 | Vulnerable | Debian |
| cpe:2.3:a:debian:libdbd-pg-perl:1.3.1:*:*:*:*:*:*:* | 1.3.1 | Vulnerable | Debian |
| cpe:2.3:a:debian:libdbd-pg-perl:1.3.2:*:*:*:*:*:*:* | 1.3.2 | Vulnerable | Debian |
| cpe:2.3:a:debian:libdbd-pg-perl:1.4.0:*:*:*:*:*:*:* | 1.4.0 | Vulnerable | Debian |
| cpe:2.3:a:debian:libdbd-pg-perl:1.4.1:*:*:*:*:*:*:* | 1.4.1 | Vulnerable | Debian |
| cpe:2.3:a:debian:libdbd-pg-perl:1.4.2:*:*:*:*:*:*:* | 1.4.2 | Vulnerable | Debian |
| cpe:2.3:a:debian:libdbd-pg-perl:1.4.3:*:*:*:*:*:*:* | 1.4.3 | Vulnerable | Debian |
| cpe:2.3:a:debian:libdbd-pg-perl:1.4.4:*:*:*:*:*:*:* | 1.4.4 | Vulnerable | Debian |
| cpe:2.3:a:debian:libdbd-pg-perl:1.4.5:*:*:*:*:*:*:* | 1.4.5 | Vulnerable | Debian |
| cpe:2.3:a:debian:libdbd-pg-perl:1.4.6:*:*:*:*:*:*:* | 1.4.6 | Vulnerable | Debian |
| cpe:2.3:a:debian:libdbd-pg-perl:1.4.7:*:*:*:*:*:*:* | 1.4.7 | Vulnerable | Debian |
| cpe:2.3:a:debian:libdbd-pg-perl:1.4.8:*:*:*:*:*:*:* | 1.4.8 | Vulnerable | Debian |
- cpe:2.3:a:debian:libdbd-pg-perl:0.63:*:*:*:*:*:*:* Versions 0.63 Vulnerable ·Debian
- cpe:2.3:a:debian:libdbd-pg-perl:0.64:*:*:*:*:*:*:* Versions 0.64 Vulnerable ·Debian
- cpe:2.3:a:debian:libdbd-pg-perl:0.65:*:*:*:*:*:*:* Versions 0.65 Vulnerable ·Debian
- cpe:2.3:a:debian:libdbd-pg-perl:0.66:*:*:*:*:*:*:* Versions 0.66 Vulnerable ·Debian
- cpe:2.3:a:debian:libdbd-pg-perl:0.67:*:*:*:*:*:*:* Versions 0.67 Vulnerable ·Debian
- cpe:2.3:a:debian:libdbd-pg-perl:0.68:*:*:*:*:*:*:* Versions 0.68 Vulnerable ·Debian
- cpe:2.3:a:debian:libdbd-pg-perl:0.69:*:*:*:*:*:*:* Versions 0.69 Vulnerable ·Debian
- cpe:2.3:a:debian:libdbd-pg-perl:0.70:*:*:*:*:*:*:* Versions 0.70 Vulnerable ·Debian
- cpe:2.3:a:debian:libdbd-pg-perl:0.71:*:*:*:*:*:*:* Versions 0.71 Vulnerable ·Debian
- cpe:2.3:a:debian:libdbd-pg-perl:0.72:*:*:*:*:*:*:* Versions 0.72 Vulnerable ·Debian
- cpe:2.3:a:debian:libdbd-pg-perl:0.73:*:*:*:*:*:*:* Versions 0.73 Vulnerable ·Debian
- cpe:2.3:a:debian:libdbd-pg-perl:0.80:*:*:*:*:*:*:* Versions 0.80 Vulnerable ·Debian
- cpe:2.3:a:debian:libdbd-pg-perl:0.81:*:*:*:*:*:*:* Versions 0.81 Vulnerable ·Debian
- cpe:2.3:a:debian:libdbd-pg-perl:0.82:*:*:*:*:*:*:* Versions 0.82 Vulnerable ·Debian
- cpe:2.3:a:debian:libdbd-pg-perl:0.83:*:*:*:*:*:*:* Versions 0.83 Vulnerable ·Debian
- cpe:2.3:a:debian:libdbd-pg-perl:0.84:*:*:*:*:*:*:* Versions 0.84 Vulnerable ·Debian
- cpe:2.3:a:debian:libdbd-pg-perl:0.85:*:*:*:*:*:*:* Versions 0.85 Vulnerable ·Debian
- cpe:2.3:a:debian:libdbd-pg-perl:0.86:*:*:*:*:*:*:* Versions 0.86 Vulnerable ·Debian
- cpe:2.3:a:debian:libdbd-pg-perl:0.87:*:*:*:*:*:*:* Versions 0.87 Vulnerable ·Debian
- cpe:2.3:a:debian:libdbd-pg-perl:0.88:*:*:*:*:*:*:* Versions 0.88 Vulnerable ·Debian
- cpe:2.3:a:debian:libdbd-pg-perl:0.89:*:*:*:*:*:*:* Versions 0.89 Vulnerable ·Debian
- cpe:2.3:a:debian:libdbd-pg-perl:0.90:*:*:*:*:*:*:* Versions 0.90 Vulnerable ·Debian
- cpe:2.3:a:debian:libdbd-pg-perl:0.91:*:*:*:*:*:*:* Versions 0.91 Vulnerable ·Debian
- cpe:2.3:a:debian:libdbd-pg-perl:0.92:*:*:*:*:*:*:* Versions 0.92 Vulnerable ·Debian
- cpe:2.3:a:debian:libdbd-pg-perl:0.93:*:*:*:*:*:*:* Versions 0.93 Vulnerable ·Debian
- cpe:2.3:a:debian:libdbd-pg-perl:0.94:*:*:*:*:*:*:* Versions 0.94 Vulnerable ·Debian
- cpe:2.3:a:debian:libdbd-pg-perl:0.95:*:*:*:*:*:*:* Versions 0.95 Vulnerable ·Debian
- cpe:2.3:a:debian:libdbd-pg-perl:0.96:*:*:*:*:*:*:* Versions 0.96 Vulnerable ·Debian
- cpe:2.3:a:debian:libdbd-pg-perl:0.97:*:*:*:*:*:*:* Versions 0.97 Vulnerable ·Debian
- cpe:2.3:a:debian:libdbd-pg-perl:0.98:*:*:*:*:*:*:* Versions 0.98 Vulnerable ·Debian
- cpe:2.3:a:debian:libdbd-pg-perl:0.99:*:*:*:*:*:*:* Versions 0.99 Vulnerable ·Debian
- cpe:2.3:a:debian:libdbd-pg-perl:1.0.0:*:*:*:*:*:*:* Versions 1.0.0 Vulnerable ·Debian
- cpe:2.3:a:debian:libdbd-pg-perl:1.0.1:*:*:*:*:*:*:* Versions 1.0.1 Vulnerable ·Debian
- cpe:2.3:a:debian:libdbd-pg-perl:1.2.0:*:*:*:*:*:*:* Versions 1.2.0 Vulnerable ·Debian
- cpe:2.3:a:debian:libdbd-pg-perl:1.2.1:*:*:*:*:*:*:* Versions 1.2.1 Vulnerable ·Debian
- cpe:2.3:a:debian:libdbd-pg-perl:1.2.2:*:*:*:*:*:*:* Versions 1.2.2 Vulnerable ·Debian
- cpe:2.3:a:debian:libdbd-pg-perl:1.3.1:*:*:*:*:*:*:* Versions 1.3.1 Vulnerable ·Debian
- cpe:2.3:a:debian:libdbd-pg-perl:1.3.2:*:*:*:*:*:*:* Versions 1.3.2 Vulnerable ·Debian
- cpe:2.3:a:debian:libdbd-pg-perl:1.4.0:*:*:*:*:*:*:* Versions 1.4.0 Vulnerable ·Debian
- cpe:2.3:a:debian:libdbd-pg-perl:1.4.1:*:*:*:*:*:*:* Versions 1.4.1 Vulnerable ·Debian
- cpe:2.3:a:debian:libdbd-pg-perl:1.4.2:*:*:*:*:*:*:* Versions 1.4.2 Vulnerable ·Debian
- cpe:2.3:a:debian:libdbd-pg-perl:1.4.3:*:*:*:*:*:*:* Versions 1.4.3 Vulnerable ·Debian
- cpe:2.3:a:debian:libdbd-pg-perl:1.4.4:*:*:*:*:*:*:* Versions 1.4.4 Vulnerable ·Debian
- cpe:2.3:a:debian:libdbd-pg-perl:1.4.5:*:*:*:*:*:*:* Versions 1.4.5 Vulnerable ·Debian
- cpe:2.3:a:debian:libdbd-pg-perl:1.4.6:*:*:*:*:*:*:* Versions 1.4.6 Vulnerable ·Debian
- cpe:2.3:a:debian:libdbd-pg-perl:1.4.7:*:*:*:*:*:*:* Versions 1.4.7 Vulnerable ·Debian
- cpe:2.3:a:debian:libdbd-pg-perl:1.4.8:*:*:*:*:*:*:* Versions 1.4.8 Vulnerable ·Debian
Remediation
Red Hat 2 advisories
- RHSA-2009:1067 Released 2009-05-26 · Red Hat rating ModerateRed Hat Application Stack v2.3 security and enhancement update
- Red Hat Application Stack v2 for Enterprise Linux (v.5) httpd-2.2.11-2.el5s2, httpd-2.2.11-2.el5s2.i386, httpd-devel-2.2.11-2.el5s2 +47
- RHSA-2009:0479 Released 2009-05-13 · Red Hat rating Moderateperl-DBD-Pg security update
- Red Hat Enterprise Linux (v. 5 server) perl-DBD-Pg-1.49-2.el5_3.1, perl-DBD-Pg-1.49-2.el5_3.1.i386, perl-DBD-Pg-1.49-2.el5_3.1.ia64 +1
- Red Hat Enterprise Linux Desktop (v. 5 client) perl-DBD-Pg-1.49-2.el5_3.1, perl-DBD-Pg-1.49-2.el5_3.1.i386
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux (v. 5 server) | Fixed | RHSA-2009:0479 |
| Red Hat Enterprise Linux Desktop (v. 5 client) | Fixed | RHSA-2009:0479 |
Timeline
- 2026-10-02 Threatist record created from CVE-2009-1341
- 2026-10-03 Alias added: GHSA-h446-mfq3-hx7g
References
Sources
- CVE-2009-1341 · CVE Program
- CVE-2009-1341 · NVD
- FIRST EPSS
- GHSA-h446-mfq3-hx7g · GitHub Advisory Database · CC BY 4.0
- CVE-2009-1341 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences