GHSA-3gjw-f78c-vvpw

Summary

tokio-postgres: Panic on a `DataRow` with fewer fields than columns allows denial of service

Severity

medium

CWE

CWE-125

Published

2026-08-24

Updated

2026-08-24

Advisory details

A malicious or compromised server can send a row containing fewer fields than its row description declares columns. Reading one of the missing columns then panics with an out-of-bounds index, aborting the calling task. This affects even the otherwise non-panicking try_get, and both Row and SimpleQueryRow.

Applications that connect only to a trusted database are not exposed; the risk applies to clients that may connect to untrusted or user-supplied servers, or whose connection can be intercepted by a man-in-the-middle.

References

• https://github.com/advisories/GHSA-3gjw-f78c-vvpw
• https://github.com/rust-postgres/rust-postgres/commit/7a00ffa9ad4d951ec0a4564b52f1780fa9d353c1
• https://github.com/rust-postgres/rust-postgres/releases/tag/tokio-postgres-v0.7.18
• https://rustsec.org/advisories/RUSTSEC-2026-0178.html

Related advisories

• RUSTSEC-2026-0178 — medium · crates.io/tokio-postgres
• CVE-2026-96639 — critical · PyPI/Pillow
• GHSA-26w7-cxv4-gfx2 — critical · npm/astro
• CVE-2026-55211 — critical · PyPI/surfio
• CVE-2026-55209 — critical · PyPI/resdata
• CVE-2023-4966 — critical · Citrix NetScaler/Citrix NetScaler ADC and NetScaler Gateway
• CVE-2026-96644 — high · PyPI/Pillow
• CVE-2026-112896 — high · PyPI/Pillow

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity