GitHub Advisoryadvisory · crates.io

GHSA-rgqc-3x5p-6gwg postgres-protocol: Panic decoding a malformed `hstore` value allows denial of service

MEDIUM Published 2026-08-24 Modified 2026-08-24 Official page ↗
Ecosystem
crates.io
Packages
postgres-protocol
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Weaknesses
CWE-20, CWE-248
Reviewed
2026-08-24

Affected packages

• crates.io postgres-protocol: < 0.6.12 → fixed in 0.6.12

Description

A malicious or compromised server can return a binary `hstore` value with an invalid internal length field, causing the client to panic while decoding it. Applications that connect only to a trusted database are not exposed; the risk applies to clients that may connect to untrusted or user-supplied servers, or whose connection can be intercepted by a man-in-the-middle.

Related

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-248 Uncaught Exception weakness

References