Summary
tokio-postgres: Panic on a `DataRow` with fewer fields than columns allows denial of service
Advisory details
A malicious or compromised server can send a row containing fewer fields than
its row description declares columns. Reading one of the missing columns then
panics with an out-of-bounds index, aborting the calling task. This affects even
the otherwise non-panicking try_get, and both Row and SimpleQueryRow.
Applications that connect only to a trusted database are not exposed; the risk applies to clients that may connect to untrusted or user-supplied servers, or whose connection can be intercepted by a man-in-the-middle.
References
Related vulnerabilities
All Supply chain →- CRITICALCVE-2026-55211
surfio has an out-of-bounds read
- CRITICALCVE-2026-55209
resdata has Classic Buffer Overflow, Improper Validation of Array Index, NULL Pointer Dereference and Out-of-bounds Read
- HIGHGHSA-jwjp-4649-v8jp
SIPSorcery vulnerable to Denial of Service via out-of-bounds read in SCTP SACK chunk parsing
- MEDIUMCVE-2026-71498
node-re2: Out-of-bounds heap read in `replace`/`split` via a `Buffer` ending in a truncated multi-byte UTF-8 character → adjacent heap memory disclosed to JavaScript
- HIGHCVE-2026-69244
AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)
- MEDIUMCVE-2026-54908
Pion DTLS vulnerable to denial of service via panic while parsing a crafted ECDHE_PSK ServerKeyExchange message