Skip to content
Problems.

Trouble with DuckDB overflow

Databases5 posts from 2 people3d active+33 posts in the last 7 days, 0 the 7 days before (rising)

Posts per day

Posts per day5 posts, Aug 28 to Sep 25

The posts behind it

5, newest first
PostDate
NewVuln12: Stack Overflow via Unbounded Recursion on Nested LIST Types### What happens? `ExtractCollationFromType()` and `ApplyCollationToType()` in `src/function/function_binder.cpp` (lines 662-718) recurse unconditionally on `LIST` child types with no depth counter or guard. When `list_contains` is bound with a deeply nested...duckdb/duckdbylwango613Sep 232 days ago
NewVuln5: Stack Overflow via Unbounded Recursion in Nested-Type Cast Binding### What happens? The nested-type cast binding functions (`BindArrayToArrayCast`, `ListBoundCastData::BindListToListCast`, etc.) recursively call `input.GetCastFunction()` on each child type without any depth limit. When the planner processes a `CAST(NULL AS INTEGER[][]...[])`...duckdb/duckdbylwango613Sep 232 days ago
NewVuln1: Unbounded Recursion in ScanNestedSchemas Causes Stack Overflow### What happens? `ScanNestedSchemas` in `src/catalog/duck_catalog.cpp` (lines 161-178) recurses into every child schema entry without any depth limit. Because `CreateSchemaInternal` imposes no cap on nesting depth, an attacker can create a schema chain of arbitrary depth via...duckdb/duckdbylwango613Sep 232 days ago
Bug93: Integer Truncation in `FirstStringStateBase::Assign` Leads to Heap Buffer Overflow with Large Strings### What happens? In `src/function/aggregate/distributive/first_last_any.cpp`, `FirstStringStateBase::Assign()` computes the arena allocation size by calling `UnsafeNumericCast (NextPowerOfTwo(len))`. For any string whose length is in the range `(2^31, 2^32-1]` - which DuckDB's...duckdb/duckdbylwango613Sep 23 weeks ago
INT_MIN % -1 raises "Overflow in division" instead of returning 0### What happens? `INT_MIN % -1` raises an error instead of returning 0. The mathematical result (0) is representable, and PostgreSQL returns 0. The error message also says "division" for a modulo operation. ### To Reproduce ### OS: macOS 15 (arm64) ### DuckDB Version:...duckdb/duckdbpeterxcliAug 284 weeks ago

Companies and products named

Company or productPosts naming it
DuckDB5
Stack Overflow3
PostgreSQL1
GitHub1
About this problem

Evidence

5 posts from 2 people in 1 place, about 1 a week over 27 days. Mostly on duckdb/duckdb. Tools named alongside: Stack Overflow, PostgreSQL, GitHub.

Frustration Frustration 0 of 3· Seen on GitHub issues

How it was grouped

Posts about DuckDB with no known issue, sharing the word "overflow". First post Aug 28, 2026, latest Sep 23, 2026. Corroborated: 3 or more posts from 2 or more people or places. Method

History

  • 2026-09-25 Added: Trouble with DuckDB overflow (5 posts)

Rising problems by email

Mondays: the problems in data, tech and AI that grew fastest that week.

Double opt-in. Unsubscribe any time.